bandit (Hex)
Advisories
31
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.14.1 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:bandit, "~> 1.14.1"} # then: mix deps.update banditKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-116078 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit |
Not rated yet EPSS 0.49% |
>= 0.3.1, < 1.14.1 | 1.14.1 |
| EEF-CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit |
Not rated yet EPSS 0.60% |
>= 0.3.4, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit |
Not rated yet EPSS 0.60% |
>= 0.3.6, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit |
Not rated yet EPSS 0.60% |
>= 0.3.3, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit |
Not rated yet EPSS 0.63% |
>= 1.9.0, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-111101 HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit |
Not rated yet EPSS 0.60% |
>= 0.1.0, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-113436 Quadratic bignum parsing of Content-Length and Host port values in Bandit |
Not rated yet EPSS 0.60% |
>= 1.0.0-pre.7, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-110314 WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit |
Not rated yet EPSS 0.38% |
>= 0.5.1, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-114213 WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit |
Not rated yet EPSS 0.60% |
>= 1.11.0, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit |
Not rated yet EPSS 0.60% |
>= 1.12.4, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit |
Not rated yet EPSS 0.60% |
>= 1.4.0, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit |
Not rated yet EPSS 0.60% |
>= 0.3.1, < 1.14.0 | 1.14.0 |
| EEF-CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit |
Not rated yet EPSS 0.62% |
>= 0.6.0, < 1.13.0 | 1.13.0 |
| EEF-CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit |
Not rated yet EPSS 0.62% |
>= 1.4.0, < 1.13.0 | 1.13.0 |
| EEF-CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit |
Not rated yet EPSS 0.71% |
>= 1.4.0, < 1.12.5 | 1.12.5 |
| EEF-CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit |
Not rated yet EPSS 0.64% |
>= 0.3.4, < 1.12.5 | 1.12.5 |
| EEF-CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit |
Not rated yet EPSS 0.48% |
>= 1.11.0, < 1.12.1 | 1.12.1 |
| EEF-CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit |
High EPSS 0.64% |
>= 1.6.0, < 1.11.1 | 1.11.1 |
| EEF-CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit |
High EPSS 0.64% |
>= 1.6.1, < 1.11.1 | 1.11.1 |
| EEF-CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit |
High EPSS 0.64% |
>= 1.4.0, < 1.11.1 | 1.11.1 |
| EEF-CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit |
High EPSS 0.64% |
>= 1.4.0, < 1.11.1 | 1.11.1 |
| EEF-CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit |
Medium EPSS 0.63% |
>= 0.1.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit |
Medium EPSS 0.63% |
< 1.11.0 | 1.11.0 |
| EEF-CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit |
High EPSS 0.76% |
>= 0.5.9, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit |
High EPSS 0.76% |
>= 0.5.8, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-39807 Client-supplied URI scheme trusted without transport verification in bandit |
Medium EPSS 0.53% |
>= 1.0.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-39807 Client-supplied URI scheme trusted without transport verification in bandit |
Medium EPSS 0.53% |
>= 1.0.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-42786 WebSocket fragmented message reassembly unbounded in bandit |
High EPSS 0.65% |
>= 0.5.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-42786 WebSocket fragmented message reassembly unbounded in bandit |
High EPSS 0.65% |
>= 0.5.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-42788 HTTP/2 frame size limit checked after body is buffered in bandit |
Medium EPSS 0.51% |
>= 0.3.5, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-42788 HTTP/2 frame size limit checked after body is buffered in bandit |
Medium EPSS 0.51% |
>= 0.3.6, < 1.11.0 | 1.11.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor