BA
Product
bandit
24
CVEs
0
On KEV
8.7
Max CVSS
14
New 30D
Severity mix
Critical 0High 17Medium 7Low 0
Watch
Add bandit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116078 New | 8.7 | Oct 28 | HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit Affected: 0.3.1 before 1.14.1; c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f before 327bb02ff84171237e1aeff787930debd16155ee |
| CVE-2026-108529 New | 8.7 | Oct 26 | SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit Affected: 0.3.4 before 1.14.0; 6feadb31189d18b7dcda6c663112cd3bbaf63a46 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-110499 New | 8.7 | Oct 26 | Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit Affected: 0.3.6 before 1.14.0; 0e68313fab9d204257ebad5c447e4cd9cea8e0ea before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-109584 New | 8.7 | Oct 26 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit Affected: 0.3.3 before 1.14.0; 44bf969cd59851622fb6ee4d16227fbc39a77fb4 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-111101 New | 8.7 | Oct 26 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit Affected: 0.1.0 before 1.14.0; 7201270c34b90f6c9e15c0386c2bb802c0c72ab4 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-113436 New | 8.7 | Oct 26 | Quadratic bignum parsing of Content-Length and Host port values in Bandit Affected: 1.0.0-pre.7 before 1.14.0; e0c8c0c30af9b0f57d8aafac37ddd9294363a8be before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-114213 New | 8.7 | Oct 26 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit Affected: 1.11.0 before 1.14.0; 21612c7c7b1ce43eccd36d3af3a2299d23513667 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-115269 New | 8.7 | Oct 26 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit Affected: 1.4.0 before 1.14.0; fff06efe3be962b484bd4d3eb339372fda5a231f before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-108525 New | 8.7 | Oct 26 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit Affected: 0.3.1 before 1.14.0; c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-105659 | 8.7 | Oct 14 | HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit Affected: 1.4.0 before 1.13.0; fff06efe3be962b484bd4d3eb339372fda5a231f before d88b21953c65061f21136ea76a89a4f95a2ac7a1 |
| CVE-2026-74836 | 8.7 | Aug 20 | HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit Affected: 0.3.4 before 1.12.5; 6feadb31189d18b7dcda6c663112cd3bbaf63a46 before f6914aad14bb1365dd6f306aa592cfb0819bed3e |
| CVE-2026-65623 | 8.7 | Jul 24 | Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit Affected: 1.11.0 before 1.12.1; 21612c7c7b1ce43eccd36d3af3a2299d23513667 before 418ef7e906192a230ddba112f7a669c87b6b0e3a |
| CVE-2026-42786 | 8.7 | May 1 | WebSocket fragmented message reassembly unbounded in bandit Affected: 0.5.0 before 1.11.0; 8909391f486d42138c5308410bc5ea49a65f4d46 before 21612c7c7b1ce43eccd36d3af3a2299d23513667 |
| CVE-2026-111103 New | 8.2 | Oct 26 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit Affected: 1.9.0 before 1.14.0; 3ad49c80c268891e7cc412e69649115456638e59 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-39804 | 8.2 | May 1 | WebSocket permessage-deflate inflate has no output-size cap in bandit Affected: 0.5.9 before 1.11.0; da4027cff7d2b80319e76fe7a32f84beceec490a before 8156921a51e684a951221da7bc30a70a022f722e |
| CVE-2026-39806 | 7.5 | May 13 | HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit Affected: 1.6.1 before 1.11.1; e73e379ab59840e8561b5730878f16e29ab06217 before ae3520dfdbfab115c638f8c7f6f6b805db34e1ab |
| CVE-2026-39803 | 7.5 | May 13 | HTTP/1 chunked body reader ignores length cap in bandit Affected: 1.4.0 before 1.11.1; 903e209a521bc216b9f9065c01ae9a0cac2d5a10 before ae3520dfdbfab115c638f8c7f6f6b805db34e1ab |
| CVE-2026-105660 | 6.9 | Oct 15 | Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit Affected: 0.6.0 before 1.13.0; 0e3edda0edf6322e9164b827c6d3ddecd080ff2e before 6ea80210137b3f69caf65f67398934259dc365d0 |
| CVE-2026-75484 | 6.9 | Aug 20 | HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit Affected: 1.4.0 before 1.12.5; fff06efe3be962b484bd4d3eb339372fda5a231f before d38cf046c9a3cae4d0f88001c2ceb4143f86366b |
| CVE-2026-42788 | 6.9 | May 1 | HTTP/2 frame size limit checked after body is buffered in bandit Affected: 0.3.6 before 1.11.0; f00dd69a5b2a4863be585907acd853c4ffd41399 before 1e8e55966da9129016b73d32f0e1df4630e3b463 |
| CVE-2026-110314 New | 6.3 | Oct 26 | WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit Affected: 0.5.1 before 1.14.0; bb407f2277dcb65a58dd8cc07913a0b58a80e266 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-114216 New | 6.3 | Oct 26 | Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit Affected: 1.12.4 before 1.14.0; c31e9e3c76dcbfc239a96eabed5341ced7885ae5 before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a |
| CVE-2026-39805 | 6.3 | May 1 | CL.CL HTTP request smuggling via duplicate Content-Length in bandit Affected: 0.1.0 before 1.11.0; 7bc8d97cd22697c299baa8012b7f419a7606a80c before f2ca636eb6df385219957e8934e9fc6efa1630d1 |
| CVE-2026-39807 | 6.3 | May 1 | Client-supplied URI scheme trusted without transport verification in bandit Affected: 1.0.0 before 1.11.0; ff2f829326cd5dcf7335939aef9775269d881e28 before 45feea20dea8af7ffd7245271107b695c040e667 |
Showing 24