CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Bandit.Pipeline'",
      "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket'"
    ],
    "packageName": "bandit",
    "packageURL": "pkg:hex/bandit",
    "product": "bandit",
    "programFiles": [
      "lib/bandit/pipeline.ex",
      "lib/bandit/http1/socket.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Bandit.Pipeline':determine_host_and_port!/4"
      },
      {
        "name": "'Elixir.Bandit.Pipeline':build_conn!/6"
      },
      {
        "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':resolve_request_target!/2"
      },
      {
        "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':validate_request_line!/2"
      }
    ],
    "repo": "https://github.com/mtrudel/bandit",
    "vendor": "mtrudel",
    "versions": [
      {
        "lessThan": "1.13.0",
        "status": "affected",
        "version": "0.6.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Bandit.Pipeline'",
      "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket'"
    ],
    "packageName": "mtrudel/bandit",
    "packageURL": "pkg:github/mtrudel/bandit",
    "product": "bandit",
    "programFiles": [
      "lib/bandit/pipeline.ex",
      "lib/bandit/http1/socket.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Bandit.Pipeline':determine_host_and_port!/4"
      },
      {
        "name": "'Elixir.Bandit.Pipeline':build_conn!/6"
      },
      {
        "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':resolve_request_target!/2"
      },
      {
        "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':validate_request_line!/2"
      }
    ],
    "repo": "https://github.com/mtrudel/bandit",
    "vendor": "mtrudel",
    "versions": [
      {
        "lessThan": "6ea80210137b3f69caf65f67398934259dc365d0",
        "status": "affected",
        "version": "0e3edda0edf6322e9164b827c6d3ddecd080ff2e",
        "versionType": "git"
      }
    ]
  }
]