These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-75484 vulnerability, known as Improper Neutralization of CRLF Sequences ('CRLF Injection'), affects the bandit product. This vulnerability allows an unauthenticated remote attacker to inject CR, LF, or NUL characters into application-visible request headers via HTTP/2. The risk lies in how downstream applications consume header values, such as logging or concatenating them into upstream reque [truncated]
CVE-2026-39806 is a high-severity denial-of-service issue in mtrudel Bandit. A flaw in chunked request parsing can leave a worker process stuck in a loop when a valid chunked body includes trailer fields, allowing unauthenticated remote attackers to consume workers until the server stops responding. The issue is fixed in Bandit 1.11.1.
CVE-2026-39803 is an unauthenticated remote denial-of-service issue in mtrudel Bandit. A chunked HTTP/1 request body can bypass the intended request-size limit, causing Bandit to buffer the full body and potentially exhaust memory before a 413 response can be issued.
The CVE record describes an Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit, which allows HTTP request smuggling via duplicate Content-Length headers. The issue arises from the 'Elixir.Bandit.Headers':get_content_length/1 function in lib/bandit/headers.ex, which uses List.keyfind/3 to return only the first matching header. This can lead to an unauthenticated attacker smuggling [truncated]