Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-108529	SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-110499	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-109584	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-111103	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.2	2026-10-26
CVE-2026-111101	HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-113436	Quadratic bignum parsing of Content-Length and Host port values in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-110314	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-10-26
CVE-2026-114213	WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-114216	Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-10-26
CVE-2026-115269	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-108525	HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-26
CVE-2026-105963	Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments	Hex / plug GitHub / elixir-plug/plug Hex / plug_crypto GitHub / elixir-plug/plug_crypto	M 5.1	2026-10-23
CVE-2026-105660	Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.9	2026-10-15
CVE-2026-105659	HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-10-14
CVE-2026-97853	Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS	Hex / decimal GitHub / ericmj/decimal	M 6.9	2026-10-10
CVE-2026-75484	HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.9	2026-08-20
CVE-2026-74836	HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-08-20
CVE-2026-65623	Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-07-24
CVE-2026-59694	Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment	Hex / mpp GitHub / zenhive/mpp	H 8.3	2026-07-17
CVE-2026-39806	HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-05-13
CVE-2026-39803	HTTP/1 chunked body reader ignores length cap in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-05-13
CVE-2026-39805	CL.CL HTTP request smuggling via duplicate Content-Length in bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-05-01
CVE-2026-39804	WebSocket permessage-deflate inflate has no output-size cap in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.2	2026-05-01
CVE-2026-39807	Client-supplied URI scheme trusted without transport verification in bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-05-01
CVE-2026-42786	WebSocket fragmented message reassembly unbounded in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-05-01

CVE-2026-108529

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Hex / bandit

GitHub / mtrudel/bandit

H 8.7

2026-10-26

CVE-2026-110499

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Hex / bandit

GitHub / mtrudel/bandit

H 8.7

2026-10-26