Bug and security fixes are provided only for the most recent version of Bandit.
Security disclosures should be submitted via GitHub's Security Advisories feature, or failing that sent privately to mat@geeky.net.
Security: mtrudel/bandit
Security
SECURITY.md
-
HTTP/2 frame size limit bypassed by late buffer check enables memory exhaustion in BanditGHSA-q6v9-r226-v65f published
May 1, 2026 by mtrudelModerate -
Bandit buffers unbounded WebSocket continuation frames, OOM-killing the hostGHSA-pf94-94m9-536p published
May 1, 2026 by mtrudelHigh -
Bandit trusts client-supplied scheme on plaintext connectionsGHSA-375f-4r2h-f99j published
May 1, 2026 by mtrudelModerate -
Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoderGHSA-rf5q-vwxw-gmrf published
May 13, 2026 by mtrudelHigh -
CL.CL request smuggling via unrejected duplicate `Content-LengthGHSA-c67r-gc9j-2qf7 published
May 1, 2026 by mtrudelModerate -
Unbounded WebSocket inflate causes BEAM OOM with a single frameGHSA-frh3-6pv6-rc8j published
May 1, 2026 by mtrudelHigh -
Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`GHSA-9q9q-324x-93r2 published
May 13, 2026 by mtrudelHigh
Learn more about advisories related to mtrudel/bandit in the GitHub Advisory Database