Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: mtrudel bandit 1.12.5 Clear all filters
TI-2026-52868 CVE-2026-75484 · GHSA-23xx-x3px-xxpj

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Priority HIGH 70

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTT…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00709 Published 2026-08-20 Fixed in 1.12.5 CWE-93
TI-2026-52571 CVE-2026-74836 · GHSA-fv6j-9p8m-c3wr

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Priority HIGH 77

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00637 Published 2026-08-20 Fixed in 1.12.5 CWE-770