Skip to contentMtrudel Bandit vulnerabilities
- mtrudel banditHTTP/2 request bodies made of 1-byte DATA frames amplify memory use in BanditCVE-2026-116078Fix available8.7 High
- mtrudel banditSETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in BanditCVE-2026-108529Fix available8.7 High
- mtrudel banditClient-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in BanditCVE-2026-110499Fix available8.7 High
- mtrudel banditHTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in BanditCVE-2026-109584Fix available8.7 High
- mtrudel banditHTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in BanditCVE-2026-111103Fix available8.2 High
- mtrudel banditHTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in BanditCVE-2026-111101Fix available8.7 High
- mtrudel banditQuadratic bignum parsing of Content-Length and Host port values in BanditCVE-2026-113436Fix available8.7 High
- mtrudel banditWebSocket frames keep reaching the WebSock after a server-initiated close in BanditCVE-2026-110314Fix available6.3 Medium
- mtrudel banditWebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in BanditCVE-2026-114213Fix available8.7 High
- mtrudel banditChunk extensions accept bare LF and CR, enabling request smuggling in BanditCVE-2026-114216Fix available6.3 Medium
- mtrudel banditHTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in BanditCVE-2026-115269Fix available8.7 High
- mtrudel banditHTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in BanditCVE-2026-108525Fix available8.7 High
- mtrudel banditUnvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in BanditCVE-2026-105660Fix available6.9 Medium
- mtrudel banditHTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in BanditCVE-2026-105659Fix available8.7 High
- mtrudel banditHTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in BanditCVE-2026-75484Fix available6.9 Medium
- mtrudel banditHTTP/2 connection-window starvation pins Plug processes indefinitely in BanditCVE-2026-74836Fix available8.7 High
- mtrudel banditQuadratic CPU blow-up reassembling fragmented WebSocket messages in BanditCVE-2026-65623Fix available8.7 High
- mtrudel banditHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditCVE-2026-39806Fix available8.7 High
- mtrudel banditHTTP/1 chunked body reader ignores length cap in banditCVE-2026-39803Fix available8.7 High
- mtrudel banditCL.CL HTTP request smuggling via duplicate Content-Length in banditCVE-2026-39805Fix available6.3 Medium
- mtrudel banditWebSocket permessage-deflate inflate has no output-size cap in banditCVE-2026-39804Fix available8.2 High
- mtrudel banditClient-supplied URI scheme trusted without transport verification in banditCVE-2026-39807Fix available6.3 Medium
- mtrudel banditWebSocket fragmented message reassembly unbounded in banditCVE-2026-42786Fix available8.7 High
- mtrudel banditHTTP/2 frame size limit checked after body is buffered in banditCVE-2026-42788Fix available6.9 Medium