CVE-2026-105660: bandit 0.6.0 to before 1.13.0

Affected technology

bandit · 0.6.0 to before 1.13.0
mtrudel

bandit · 0e3edda0edf6322e9164b827c6d3ddecd080ff2e to before 6ea80210137b3f69caf65f67398934259dc365d0
mtrudel

Component: 'Elixir.Bandit.Pipeline', 'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket'
Function: 'Elixir.Bandit.Pipeline':determine_host_and_port!/4, 'Elixir.Bandit.Pipeline':build_conn!/6, 'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':resolve_request_target!/2, 'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':validate_request_line!/2
File: lib/bandit/pipeline.ex, lib/bandit/http1/socket.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.