CVE-2026-105660
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The bandit library (versions 0.6.0 to 1.13.0) improperly validates syntactic correctness of input. An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target, potentially injecting malicious values into URLs generated by the application.
Risk Assessment
Applications building absolute URLs from conn.host may generate links pointing to attacker-controlled domains, enabling phishing or user redirection.
Recommendation
Update the bandit library to version 1.13.0 or later, which properly validates authority in HTTP requests.
Other vulnerabilities in bandit
See all- CVE-2026-42786High
A vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion, enabling unauthorized users to send an unbounded number of continuation frames. The issue occurs in the handle_frame/3 method, which lacks size limits for accumulated data.
- CVE-2026-105659High
In the mtrudel bandit library, an unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by trickling small WINDOW_UPDATE frames. Each partial progress resets deadlines, so the blocked stream process, its Plug state and held resources stay alive as long as the attacker keeps dripping, exhausting server processes and memory. This issue affects bandit from 1.4.0 before 1.13.0.
- CVE-2026-75484Medium
CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.
- CVE-2026-74836High
A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.
- CVE-2026-65623High
Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.
- CVE-2026-39805Medium
A vulnerability in the Bandit library (Elixir) allows HTTP request smuggling via duplicate Content-Length headers. The server accepts the first header and treats the remaining data as a subsequent request on the same connection.
Original NVD description (English source)
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://[email protected]/x HTTP/1.1 with a valid Host header yields a conn.host of [email protected], and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port. Applications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host. This issue affects bandit: from 0.6.0 before 1.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS