bandit vulnerabilities (Hex)
24 vulnerabilities.
-
banditHex HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit 8.7 High -
banditHex SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit 8.7 High -
banditHex Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit 8.7 High -
banditHex HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit 8.7 High -
banditHex HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit 8.2 High -
banditHex HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit 8.7 High -
banditHex Quadratic bignum parsing of Content-Length and Host port values in Bandit 8.7 High -
banditHex WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit 6.3 Medium -
banditHex WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit 8.7 High -
banditHex Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit 6.3 Medium -
banditHex HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit 8.7 High -
banditHex HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit 8.7 High -
banditHex Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit 6.9 Medium -
banditHex HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit 8.7 High -
banditHex HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit 6.9 Medium -
banditHex HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit 8.7 High -
banditHex Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit 8.7 High -
banditHex HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit 8.7 High -
banditHex HTTP/1 chunked body reader ignores length cap in bandit 8.7 High -
banditHex CL.CL HTTP request smuggling via duplicate Content-Length in bandit 6.3 Medium -
banditHex WebSocket permessage-deflate inflate has no output-size cap in bandit 8.2 High -
banditHex Client-supplied URI scheme trusted without transport verification in bandit 6.3 Medium -
banditHex WebSocket fragmented message reassembly unbounded in bandit 8.7 High -
banditHex HTTP/2 frame size limit checked after body is buffered in bandit 6.9 Medium