CVE-2026-105660 in bandit
Summary
by MITRE • 10/15/2026
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://[email protected]/x HTTP/1.1 with a valid Host header yields a conn.host of [email protected], and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port.
Applications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host.
This issue affects bandit: from 0.6.0 before 1.13.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Bandit represents a critical failure in input validation regarding the syntactic correctness of HTTP request targets, specifically affecting versions from 0.6.0 up to but not including 1.13.0. This flaw allows an unauthenticated remote attacker to manipulate internal connection state variables by exploiting the precedence rules defined in RFC 9112 for HTTP/1 message framing and routing. While Bandit correctly validates the Host header against malformed inputs, returning a 400 Bad Request status when necessary, it fails to apply equivalent validation logic to the authority component of absolute-form or authority-form request targets. According to RFC standards, if an absolute URI is provided in the request line, that authority takes precedence over the Host header for determining the target host and port. Bandit’s pipeline implementation passes this extracted authority directly to the application layer without performing rigorous syntactic checks against RFC 3986 specifications.
The technical core of this vulnerability lies in how the conn.host and conn.port fields are populated within the connection struct. When a client sends an HTTP/1 request with an absolute URI, such as GET http://good.exampleevil.example/x HTTP/1.1, Bandit extracts the authority from that URI rather than relying solely on the Host header. This results in conn.host being set to values like good.exampleevil.example, which includes characters and structures not permitted by standard host grammar rules. Furthermore, this lack of validation extends to other control characters such as NUL (0x00), DEL (0x7F), and non-ASCII bytes, as well as invalid IP literals and port numbers outside the valid range of 1 through 65535. In HTTP/1.0 requests that do not include a Host header, or CONNECT method requests where the unparsed port string is placed directly into conn.port, similar validation gaps exist, allowing attackers to inject arbitrary data into these critical connection parameters.
The operational impact of this vulnerability is significant for applications built on top of Bandit, particularly those utilizing Plug.Conn.request_url/1 or Phoenix URL helpers to construct absolute URLs. These functions rely heavily on the values stored in conn.host and conn.port to generate links back to clients or other services. Because an attacker can control these fields through malicious request targets, they can force the application to emit hyperlinks with authorities chosen by the attacker rather than the legitimate server domain. This capability facilitates Host Header Injection attacks, which are commonly leveraged for phishing campaigns where victims are directed to look-alike domains that appear authentic due to the injected authority component. Additionally, it enables Open Redirect vulnerabilities if downstream logic uses these values to redirect users or process webhooks without further verification.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-611 Improper Restriction of XML External Entity Reference in broader contexts of untrusted data handling, though more specifically it maps to CWE-749 Exposed Dangerous Method or Property if the internal state is considered sensitive. In terms of attack vectors, this vulnerability supports techniques described in MITRE ATT&CK under T1132 Data Encoding for Obfuscated Headers and potentially contributes to credential harvesting via phishing through T1566 Phishing. The fact that message framing remains unaffected indicates that while the application logic can be subverted, low-level protocol parsing is not compromised, limiting the risk of buffer overflows or memory corruption but maintaining a high risk for logical exploitation and social engineering attacks.
Mitigation strategies must focus on enforcing strict validation at the pipeline level before any data reaches the application context. Developers should ensure that conn.host and conn.port are validated against RFC 3986 host grammar rules immediately after extraction from the request target, regardless of whether the authority came from the Host header or the URI itself. This includes rejecting inputs containing NUL bytes, DEL characters, non-ASCII sequences, invalid IP formats, and out-of-range port numbers. Upgrading to Bandit version 1.13.0 or later is the primary remediation step as it addresses these validation gaps. For environments where upgrading is not immediately feasible, implementing a custom plug in the application pipeline that sanitizes conn.host and conn.port based on strict regex patterns matching valid hostnames and port ranges can provide temporary protection against exploitation attempts.