Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: mtrudel bandit 1.11.0 Clear all filters
TI-2026-28688 CVE-2026-39805 · GHSA-c67r-gc9j-2qf7

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

Priority HIGH 67

Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00626 Published 2026-05-01 Fixed in 1.11.0 CWE-444
TI-2026-28687 CVE-2026-39804 · GHSA-frh3-6pv6-rc8j

WebSocket permessage-deflate inflate has no output-size cap in bandit

Priority HIGH 75

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00759 Published 2026-05-01 Fixed in 1.11.0 CWE-770
TI-2026-31007 CVE-2026-42786 · GHSA-pf94-94m9-536p

WebSocket fragmented message reassembly unbounded in bandit

Priority HIGH 77

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00647 Published 2026-05-01 Fixed in 1.11.0 CWE-770
TI-2026-31008 CVE-2026-42788 · GHSA-q6v9-r226-v65f

HTTP/2 frame size limit checked after body is buffered in bandit

Priority HIGH 70

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized HTTP/2 frames.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2026-05-01 Fixed in 1.11.0 CWE-770