Hex Package Vulnerabilities
Vulnerabilities associated with bandit.
Packages
Clear package- hackney12 vulnerabilities
- bandit7 vulnerabilities
- tesla5 vulnerabilities
- ash4 vulnerabilities
- cowlib4 vulnerabilities
- gun4 vulnerabilities
- mint4 vulnerabilities
- plug4 vulnerabilities
- rabbit_common4 vulnerabilities
- ewe3 vulnerabilities
- phoenix3 vulnerabilities
- phoenix_storybook3 vulnerabilities
- absinthe2 vulnerabilities
- ash_authentication2 vulnerabilities
- cowboy2 vulnerabilities
- hex_core2 vulnerabilities
- oban_web2 vulnerabilities
- phoenix_html2 vulnerabilities
- pow2 vulnerabilities
- req2 vulnerabilities
- wisp2 vulnerabilities
- MongooseIM1 vulnerability
- RabbitMQ1 vulnerability
- Samly1 vulnerability
- absinthe_plug1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-39806HIGH | HTTP/1 chunked decoder infinite loop on requests with trailer fields in banditLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm compu… CWE-835May 13, 2026 | CVSS8.7v4.0 | EPSS0.637% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39803HIGH | HTTP/1 chunked body reader ignores length cap in banditAllocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iol… CWE-770May 13, 2026 | CVSS8.7v4.0 | EPSS0.642% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39805MEDIUM | CL.CL HTTP request smuggling via duplicate Content-Length in banditInconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers. 'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a request contains two Content-Length headers with different values, Bandit silently accepts it, uses the first value to read the body, and dispatches the remaining bytes as a second pipelined request on the same… CWE-444May 1, 2026 | CVSS6.3v4.0 | EPSS0.518% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39804HIGH | WebSocket permessage-deflate inflate has no output-size cap in banditAllocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option… CWE-770May 1, 2026 | CVSS8.2v4.0 | EPSS0.625% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39807MEDIUM | Client-supplied URI scheme trusted without transport verification in banditReliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this fu… CWE-807May 1, 2026 | CVSS6.3v4.0 | EPSS0.454% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42786HIGH | WebSocket fragmented message reassembly unbounded in banditAllocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in 'Elixir.Bandit.WebSocket.Connection':handle_frame/3 in lib/bandit/websocket/connection.ex appends every incoming Continuation{fin: false} frame's payload to a per-connection iolist with no cumulative size cap. The existing max_frame_size option only bounds individual frames; a peer that streams an unbounded nu… CWE-770May 1, 2026 | CVSS8.7v4.0 | EPSS0.549% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42788MEDIUM | HTTP/2 frame size limit checked after body is buffered in banditAllocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames. 'Elixir.Bandit.HTTP2.Frame':deserialize/2 in lib/bandit/http2/frame.ex checks the SETTINGS_MAX_FRAME_SIZE limit only after pattern-matching payload::binary-size(length), which requires the entire frame body to be present in memory before either the accept or reject clause can fire. A peer that announces a frame length up to the 24-bit maximum… CWE-770May 1, 2026 | CVSS6.9v4.0 | EPSS0.51% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |