https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 13:08:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114216 <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.</p> <p>The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.</p> <p>This issue affects bandit: from 1.12.4 before 1.14.0.</p> <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.</p> <p>The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.</p> <p>This issue affects bandit: from 1.12.4 before 1.14.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114216 https://db.gcve.eu/vuln/ubuntu-cve-2026-114216 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: bandit, Ubuntu:18.04:LTS: bandit, Ubuntu:20.04:LTS: bandit, Ubuntu:22.04:LTS: bandit, Ubuntu:24.04:LTS: bandit, Ubuntu:26.10: bandit, Ubuntu:26.04:LTS: bandit</p> <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected. This issue affects bandit: from 1.12.4 before 1.14.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: bandit, Ubuntu:18.04:LTS: bandit, Ubuntu:20.04:LTS: bandit, Ubuntu:22.04:LTS: bandit, Ubuntu:24.04:LTS: bandit, Ubuntu:26.10: bandit, Ubuntu:26.04:LTS: bandit</p> <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected. This issue affects bandit: from 1.12.4 before 1.14.0.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-114216