mtrudel bandit up to 0.6.0/1.12.0 Request Target Authority lib/bandit/pipeline.ex Bandit.Pipeline.determine_host_and_port host/port input validation

Summaryinfo

A vulnerability was found in mtrudel bandit up to 0.6.0/1.12.0. It has been classified as critical. The affected element is the function Bandit.Pipeline.determine_host_and_port of the file lib/bandit/pipeline.ex of the component Request Target Authority. Performing a manipulation of the argument host/port results in input validation. This vulnerability is cataloged as CVE-2026-105660. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in mtrudel bandit up to 0.6.0/1.12.0. This affects the function Bandit.Pipeline.determine_host_and_port of the file lib/bandit/pipeline.ex of the component Request Target Authority. The manipulation of the argument host/port with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://[email protected]/x HTTP/1.1 with a valid Host header yields a conn.host of [email protected], and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port. Applications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host. This issue affects bandit: from 0.6.0 before 1.13.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-105660 since 10/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.13.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• mtrudel

Name

• bandit

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6.0
• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12.0

Website

• Product: https://github.com/mtrudel/bandit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion