bandit

.. image:: https://raw.githubusercontent.com/pycqa/bandit/main/logo/logotype-sm.png :alt: Bandit ====== .. image:: https://github.com/PyCQA/bandit/actions/workflows/pythonpackage.yml/badge.svg?branch=main :target:...

salus

Salus: Guardian of Code Safety and Security 🔍 Overview Salus Security Automation as a Lightweight Universal Scanner, named after the Roman goddess of protection, is a tool for coordinating the execution of security scanners. You can run Salus on a repository via the Docker daemon and it will...

CVE-2026-74836

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-75484

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EUVD-2026-63661

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

CVE-2026-75484

CVE-2026-75484 is a CRLF injection vulnerability in mtrudel bandit (Elixir HTTP server), versions 1.4.0 through before 1.12.5 . The root cause is in Bandit.HTTP2.Stream.read_headers/1, which validates header structure but never inspects field values . Because HPACK carries arbitrary octets, an un...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EEF-CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placemen...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EUVD-2026-63660

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

EEF-CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836

CVE-2026-74836 is an unbounded resource exhaustion vulnerability in mtrudel/bandit (Erlang HTTP/2 server library), affecting versions 0.3.4 through before 1.12.5 . When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes), the stream process blocks indef...

PT-2026-79146

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.4 through 1.12.4 Description An unauthenticated remote attacker can pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting connection-level flow control. When a stream response body exceeds the HTTP/2...

CVE-2026-75484: Improper Neutralization of CRLF Sequences

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

PT-2026-79147

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.12.4 Description An improper neutralization of CRLF sequences allows an unauthenticated remote attacker to smuggle Carriage Return CR, Line Feed LF, or Null NUL characters into application-visible request header...

CVE-2026-74836: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...