mtrudel vulnerabilities

Newest CVEs

• CVE-2026-116078

  HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-108529

  SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-110499

  Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-109584

  HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-111103

  HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

  mtrudel · bandit

  High8.2
• CVE-2026-111101

  HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-113436

  Quadratic bignum parsing of Content-Length and Host port values in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-110314

  WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

  mtrudel · bandit

  Medium6.3
• CVE-2026-114213

  WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

  mtrudel · bandit

  High8.7
• CVE-2026-114216

  Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

  mtrudel · bandit

  Medium6.3