Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

hex

bandit

hex

A pure-Elixir HTTP server built for Plug & WebSock apps

View on github.com · View on hex.pm

Security Advisories for bandit in hex

High
19 days ago

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit EEF-CVE-2026-65623

hex bandit
High
3 months ago

Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder GSA_kwCzR0hTQS1yZjVxLXZ3eHctZ21yZs4ABXHZ

hex bandit
High
3 months ago

Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked` GSA_kwCzR0hTQS05cTlxLTMyNHgtOTNyMs4ABXHY

hex bandit
High
3 months ago

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit EEF-CVE-2026-39806

hex bandit
High
3 months ago

HTTP/1 chunked body reader ignores length cap in bandit EEF-CVE-2026-39803

hex bandit
Moderate
3 months ago

Bandit HTTP/2 Frame Size Limit Bypass via Late Buffer Check Enables Memory Exhaustion GSA_kwCzR0hTQS1xNnY5LXIyMjYtdjY1Zs4ABWYH

hex bandit
Moderate
3 months ago

Bandit trusts client-supplied URI scheme on plaintext connections GSA_kwCzR0hTQS0zNzVmLTRyMmgtZjk5as4ABWYG

hex bandit
Moderate
3 months ago

Bandit is vulnerable to CL.CL request smuggling via unrejected duplicate `Content-Length` header GSA_kwCzR0hTQS1jNjdyLWdjOWotMnFmN84ABWYF

hex bandit
High
3 months ago

Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion GSA_kwCzR0hTQS1wZjk0LTk0bTktNTM2cM4ABWYE

hex bandit
High
3 months ago

Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame GSA_kwCzR0hTQS1mcmgzLTZwdjYtcmM4as4ABWYD

hex bandit
Medium
3 months ago

CL.CL HTTP request smuggling via duplicate Content-Length in bandit EEF-CVE-2026-39805

hex bandit
High
3 months ago

WebSocket permessage-deflate inflate has no output-size cap in bandit EEF-CVE-2026-39804

hex bandit
Medium
3 months ago

Client-supplied URI scheme trusted without transport verification in bandit EEF-CVE-2026-39807

hex bandit
High
3 months ago

WebSocket fragmented message reassembly unbounded in bandit EEF-CVE-2026-42786

hex bandit
Medium
3 months ago

HTTP/2 frame size limit checked after body is buffered in bandit EEF-CVE-2026-42788

hex bandit

Filter by Severity

High 9 Moderate 3 Medium 3