hex bandit vulnerabilities

Latest hex bandit CVEs

Newest publication first

1. CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.64%

   Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-c...

2. CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.64%

   Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :le...

3. CVE-2026-39805 CL.CL HTTP request smuggling via duplicate Content-Length in bandit

   Published 2026-05-01

   Medium·CVSS 6.3 EPSS 0.63%

   Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers. 'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header...

4. CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit

   Published 2026-05-01

   High·CVSS 8.2 EPSS 0.76%

   Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit...

5. CVE-2026-39807 Client-supplied URI scheme trusted without transport verification in bandit

   Published 2026-05-01

   Medium·CVSS 6.3 EPSS 0.53%

   Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim...

6. CVE-2026-42786 WebSocket fragmented message reassembly unbounded in bandit

   Published 2026-05-01

   High·CVSS 8.7 EPSS 0.65%

   Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in 'Elixir.Bandit.WebSocket.Connection':handle_frame/3 in lib/bandit/websocket/connection.ex ap...

7. CVE-2026-42788 HTTP/2 frame size limit checked after body is buffered in bandit

   Published 2026-05-01

   Medium·CVSS 6.9 EPSS 0.51%

   Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames. 'Elixir.Bandit.HTTP2.Frame':deserialize/2 in lib/bandit/http2/frame.ex checks the SETTINGS_MAX_FRAME_SIZE limit only after pa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.