CVE-2026-105660 (GCVE-0-2026-105660)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:37 – Updated: 2026-10-15 18:37
VLAI
EPSS
VEX
Title
Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
Summary
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://good.example@evil.example/x HTTP/1.1 with a valid Host header yields a conn.host of good.example@evil.example, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port.
Applications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host.
This issue affects bandit: from 0.6.0 before 1.13.0.
Severity
CWE
- CWE-1286 - Improper Validation of Syntactic Correctness of Input
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mtrudel/bandit/security/adviso… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-105660.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-105660 | related |
| https://github.com/mtrudel/bandit/commit/0e3edda0… | related |
| https://github.com/mtrudel/bandit/commit/6ea80210… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Bandit.Pipeline\u0027",
"\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027"
],
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/pipeline.ex",
"lib/bandit/http1/socket.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:determine_host_and_port!/4"
},
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:build_conn!/6"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:resolve_request_target!/2"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:validate_request_line!/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.13.0",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Bandit.Pipeline\u0027",
"\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027"
],
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/pipeline.ex",
"lib/bandit/http1/socket.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:determine_host_and_port!/4"
},
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:build_conn!/6"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:resolve_request_target!/2"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:validate_request_line!/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "6ea80210137b3f69caf65f67398934259dc365d0",
"status": "affected",
"version": "0e3edda0edf6322e9164b827c6d3ddecd080ff2e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.13.0",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Mat Trudel"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
}
],
"dateAssigned": "2026-10-14T21:42:16.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set \u003ccode\u003econn.host\u003c/code\u003e and \u003ccode\u003econn.port\u003c/code\u003e to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the \u003ccode\u003eHost\u003c/code\u003e header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and \u003ccode\u003eBandit.Pipeline.determine_host_and_port!/4\u003c/code\u003e in \u003ccode\u003elib/bandit/pipeline.ex\u003c/code\u003e passes it to the application unchecked. A request line such as \u003ccode\u003eGET http://good.example@evil.example/x HTTP/1.1\u003c/code\u003e with a valid \u003ccode\u003eHost\u003c/code\u003e header yields a \u003ccode\u003econn.host\u003c/code\u003e of \u003ccode\u003egood.example@evil.example\u003c/code\u003e, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no \u003ccode\u003eHost\u003c/code\u003e header at all, and \u003ccode\u003eCONNECT\u003c/code\u003e places the unparsed port string in \u003ccode\u003econn.port\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eApplications that build absolute URLs from \u003ccode\u003econn.host\u003c/code\u003e, such as through \u003ccode\u003ePlug.Conn.request_url/1\u003c/code\u003e or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach \u003ccode\u003econn.host\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.6.0 before 1.13.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set `conn.host` and `conn.port` to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the `Host` header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and `Bandit.Pipeline.determine_host_and_port!/4` in `lib/bandit/pipeline.ex` passes it to the application unchecked. A request line such as `GET http://good.example@evil.example/x HTTP/1.1` with a valid `Host` header yields a `conn.host` of `good.example@evil.example`, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no `Host` header at all, and `CONNECT` places the unparsed port string in `conn.port`.\n\nApplications that build absolute URLs from `conn.host`, such as through `Plug.Conn.request_url/1` or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach `conn.host`.\n\nThis issue affects bandit: from 0.6.0 before 1.13.0."
}
],
"value": "Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://good.example@evil.example/x HTTP/1.1 with a valid Host header yields a conn.host of good.example@evil.example, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port.\n\nApplications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host.\n\nThis issue affects bandit: from 0.6.0 before 1.13.0."
}
],
"impacts": [
{
"capecId": "CAPEC-220",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can make the application see any host string and any port number as the request\u0027s authority, bypassing the validation applied to the \u003ccode\u003eHost\u003c/code\u003e header. An application that builds absolute URLs from \u003ccode\u003econn.host\u003c/code\u003e, such as password-reset or verification links, emits links whose host the attacker chose.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make the application see any host string and any port number as the request\u0027s authority, bypassing the validation applied to the `Host` header. An application that builds absolute URLs from `conn.host`, such as password-reset or verification links, emits links whose host the attacker chose."
}
],
"value": "An unauthenticated client can make the application see any host string and any port number as the request\u0027s authority, bypassing the validation applied to the Host header. An application that builds absolute URLs from conn.host, such as password-reset or verification links, emits links whose host the attacker chose."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1286",
"description": "CWE-1286 Improper Validation of Syntactic Correctness of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:37:02.485Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-v53v-9hvg-37jf"
},
{
"name": "EEF CNA record for CVE-2026-105660",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-105660.html"
},
{
"name": "OSV record EEF-CVE-2026-105660",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105660"
},
{
"name": "Introducing commit 0e3edda in mtrudel/bandit",
"tags": [
"related"
],
"url": "https://github.com/mtrudel/bandit/commit/0e3edda0edf6322e9164b827c6d3ddecd080ff2e"
},
{
"name": "Fix commit 6ea8021 in mtrudel/bandit",
"tags": [
"patch"
],
"url": "https://github.com/mtrudel/bandit/commit/6ea80210137b3f69caf65f67398934259dc365d0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAdd a plug ahead of any code that reads \u003ccode\u003econn.host\u003c/code\u003e or \u003ccode\u003econn.port\u003c/code\u003e that compares \u003ccode\u003econn.host\u003c/code\u003e against an allow-list of the hostnames the application serves, checks that \u003ccode\u003econn.port\u003c/code\u003e is an integer, and halts the request with a 400 response otherwise. Do not derive absolute URLs from \u003ccode\u003econn.host\u003c/code\u003e until that check has passed.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Add a plug ahead of any code that reads `conn.host` or `conn.port` that compares `conn.host` against an allow-list of the hostnames the application serves, checks that `conn.port` is an integer, and halts the request with a 400 response otherwise. Do not derive absolute URLs from `conn.host` until that check has passed."
}
],
"value": "Add a plug ahead of any code that reads conn.host or conn.port that compares conn.host against an allow-list of the hostnames the application serves, checks that conn.port is an integer, and halts the request with a 400 response otherwise. Do not derive absolute URLs from conn.host until that check has passed."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart Bandit over plaintext HTTP with a plug that returns \u003ccode\u003econn.host\u003c/code\u003e and \u003ccode\u003econn.port\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOpen a raw TCP connection to the listener and send \u003ccode\u003eGET http://good.example@evil.example/x HTTP/1.1\u003c/code\u003e followed by \u003ccode\u003eHost: good.example\u003c/code\u003e and an empty line. The response is 200 and \u003ccode\u003econn.host\u003c/code\u003e is \u003ccode\u003egood.example@evil.example\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRepeat with \u003ccode\u003eGET http://ex\\x00am.com/x HTTP/1.1\u003c/code\u003e (a NUL byte in the authority) or \u003ccode\u003eGET http://ex.com:99999/x HTTP/1.1\u003c/code\u003e. Both are accepted, with the NUL byte in \u003ccode\u003econn.host\u003c/code\u003e and 99999 in \u003ccode\u003econn.port\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend the same bytes in the \u003ccode\u003eHost\u003c/code\u003e header of an origin-form request instead. Bandit answers 400 for the NUL byte and the out-of-range port on 1.12.5, and for every payload once the \u003ccode\u003eHost\u003c/code\u003e grammar tightening on main is released.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003eGET http://good.example@evil.example/x HTTP/1.0\u003c/code\u003e with no \u003ccode\u003eHost\u003c/code\u003e header, or \u003ccode\u003eCONNECT good.example@evil.example:443 HTTP/1.1\u003c/code\u003e. Both are accepted, and the \u003ccode\u003eCONNECT\u003c/code\u003e form leaves \u003ccode\u003econn.port\u003c/code\u003e as the binary \u003ccode\u003e\"443\"\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start Bandit over plaintext HTTP with a plug that returns `conn.host` and `conn.port`.\n2. Open a raw TCP connection to the listener and send `GET http://good.example@evil.example/x HTTP/1.1` followed by `Host: good.example` and an empty line. The response is 200 and `conn.host` is `good.example@evil.example`.\n3. Repeat with `GET http://ex\\x00am.com/x HTTP/1.1` (a NUL byte in the authority) or `GET http://ex.com:99999/x HTTP/1.1`. Both are accepted, with the NUL byte in `conn.host` and 99999 in `conn.port`.\n4. Send the same bytes in the `Host` header of an origin-form request instead. Bandit answers 400 for the NUL byte and the out-of-range port on 1.12.5, and for every payload once the `Host` grammar tightening on main is released.\n5. Send `GET http://good.example@evil.example/x HTTP/1.0` with no `Host` header, or `CONNECT good.example@evil.example:443 HTTP/1.1`. Both are accepted, and the `CONNECT` form leaves `conn.port` as the binary `\"443\"`."
}
],
"value": "* Start Bandit over plaintext HTTP with a plug that returns conn.host and conn.port.\n* Open a raw TCP connection to the listener and send GET http://good.example@evil.example/x HTTP/1.1 followed by Host: good.example and an empty line. The response is 200 and conn.host is good.example@evil.example.\n* Repeat with GET http://ex\\x00am.com/x HTTP/1.1 (a NUL byte in the authority) or GET http://ex.com:99999/x HTTP/1.1. Both are accepted, with the NUL byte in conn.host and 99999 in conn.port.\n* Send the same bytes in the Host header of an origin-form request instead. Bandit answers 400 for the NUL byte and the out-of-range port on 1.12.5, and for every payload once the Host grammar tightening on main is released.\n* Send GET http://good.example@evil.example/x HTTP/1.0 with no Host header, or CONNECT good.example@evil.example:443 HTTP/1.1. Both are accepted, and the CONNECT form leaves conn.port as the binary \"443\"."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Request-target parsing\u003c/strong\u003e (\u003ccode\u003elib/bandit/http1/socket.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003e:erlang.decode_packet/3\u003c/code\u003e returns an absolute-form target as \u003ccode\u003e{:absoluteURI, scheme, host, port, path}\u003c/code\u003e and an authority-form (\u003ccode\u003eCONNECT\u003c/code\u003e) target as \u003ccode\u003e{:scheme, host, port}\u003c/code\u003e. \u003ccode\u003eresolve_request_target!/2\u003c/code\u003e unwraps both into a \u003ccode\u003e{scheme, host, port, path}\u003c/code\u003e tuple and forwards \u003ccode\u003ehost\u003c/code\u003e and \u003ccode\u003eport\u003c/code\u003e as received. \u003ccode\u003evalidate_request_line!/2\u003c/code\u003e only rejects bytes at or below \u003ccode\u003e0x20\u003c/code\u003e and \u003ccode\u003e0x7F\u003c/code\u003e, so userinfo, delimiters, backslashes, bytes \u003ccode\u003e0x80\u003c/code\u003e to \u003ccode\u003e0xFF\u003c/code\u003e, invalid IP literals and out-of-range ports pass. For \u003ccode\u003eCONNECT\u003c/code\u003e, \u003ccode\u003eport\u003c/code\u003e is the unparsed text after the first colon.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Host selection\u003c/strong\u003e (\u003ccode\u003elib/bandit/pipeline.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003edetermine_host_and_port!/4\u003c/code\u003e has three clauses. The HTTP/1.1 clause calls \u003ccode\u003erequired_host_header!/1\u003c/code\u003e, which parses the \u003ccode\u003eHost\u003c/code\u003e header with \u003ccode\u003eBandit.Headers.parse_hostlike_header!/1\u003c/code\u003e and raises a 400 on a malformed value, and then discards that result whenever \u003ccode\u003etarget_host\u003c/code\u003e is set, returning \u003ccode\u003eto_string(target_host)\u003c/code\u003e and \u003ccode\u003etarget_port\u003c/code\u003e instead. The fallback clause used for HTTP/1.0 and for \u003ccode\u003eCONNECT\u003c/code\u003e returns the target host and port directly and never consults the \u003ccode\u003eHost\u003c/code\u003e header. The precedence itself follows RFC 9112 section 3.2.2; the defect is that the value which wins is the one never validated.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Effect\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ebuild_conn!/6\u003c/code\u003e places the pair into the \u003ccode\u003eURI\u003c/code\u003e from which \u003ccode\u003ePlug.Conn.Adapter.conn/5\u003c/code\u003e builds \u003ccode\u003econn.host\u003c/code\u003e and \u003ccode\u003econn.port\u003c/code\u003e. The application therefore sees host values Bandit rejects on every other route into the same field, and for \u003ccode\u003eCONNECT\u003c/code\u003e a binary where \u003ccode\u003ePlug.Conn.port_number/0\u003c/code\u003e promises an integer, which makes \u003ccode\u003ePlug.Conn.request_url/1\u003c/code\u003e raise.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Request-target parsing** (`lib/bandit/http1/socket.ex`)\n\n`:erlang.decode_packet/3` returns an absolute-form target as `{:absoluteURI, scheme, host, port, path}` and an authority-form (`CONNECT`) target as `{:scheme, host, port}`. `resolve_request_target!/2` unwraps both into a `{scheme, host, port, path}` tuple and forwards `host` and `port` as received. `validate_request_line!/2` only rejects bytes at or below `0x20` and `0x7F`, so userinfo, delimiters, backslashes, bytes `0x80` to `0xFF`, invalid IP literals and out-of-range ports pass. For `CONNECT`, `port` is the unparsed text after the first colon.\n\n**2. Host selection** (`lib/bandit/pipeline.ex`)\n\n`determine_host_and_port!/4` has three clauses. The HTTP/1.1 clause calls `required_host_header!/1`, which parses the `Host` header with `Bandit.Headers.parse_hostlike_header!/1` and raises a 400 on a malformed value, and then discards that result whenever `target_host` is set, returning `to_string(target_host)` and `target_port` instead. The fallback clause used for HTTP/1.0 and for `CONNECT` returns the target host and port directly and never consults the `Host` header. The precedence itself follows RFC 9112 section 3.2.2; the defect is that the value which wins is the one never validated.\n\n**3. Effect**\n\n`build_conn!/6` places the pair into the `URI` from which `Plug.Conn.Adapter.conn/5` builds `conn.host` and `conn.port`. The application therefore sees host values Bandit rejects on every other route into the same field, and for `CONNECT` a binary where `Plug.Conn.port_number/0` promises an integer, which makes `Plug.Conn.request_url/1` raise."
}
],
"value": "1. Request-target parsing (lib/bandit/http1/socket.ex)\n\n:erlang.decode_packet/3 returns an absolute-form target as {:absoluteURI, scheme, host, port, path} and an authority-form (CONNECT) target as {:scheme, host, port}. resolve_request_target!/2 unwraps both into a {scheme, host, port, path} tuple and forwards host and port as received. validate_request_line!/2 only rejects bytes at or below 0x20 and 0x7F, so userinfo, delimiters, backslashes, bytes 0x80 to 0xFF, invalid IP literals and out-of-range ports pass. For CONNECT, port is the unparsed text after the first colon.\n\n2. Host selection (lib/bandit/pipeline.ex)\n\ndetermine_host_and_port!/4 has three clauses. The HTTP/1.1 clause calls required_host_header!/1, which parses the Host header with Bandit.Headers.parse_hostlike_header!/1 and raises a 400 on a malformed value, and then discards that result whenever target_host is set, returning to_string(target_host) and target_port instead. The fallback clause used for HTTP/1.0 and for CONNECT returns the target host and port directly and never consults the Host header. The precedence itself follows RFC 9112 section 3.2.2; the defect is that the value which wins is the one never validated.\n\n3. Effect\n\nbuild_conn!/6 places the pair into the URI from which Plug.Conn.Adapter.conn/5 builds conn.host and conn.port. The application therefore sees host values Bandit rejects on every other route into the same field, and for CONNECT a binary where Plug.Conn.port_number/0 promises an integer, which makes Plug.Conn.request_url/1 raise."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-105660",
"datePublished": "2026-10-15T18:37:02.485Z",
"dateReserved": "2026-10-10T13:15:02.320Z",
"dateUpdated": "2026-10-15T18:37:02.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Bandit.Pipeline\u0027",
"\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027"
],
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/pipeline.ex",
"lib/bandit/http1/socket.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:determine_host_and_port!/4"
},
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:build_conn!/6"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:resolve_request_target!/2"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:validate_request_line!/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.13.0",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Bandit.Pipeline\u0027",
"\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027"
],
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/pipeline.ex",
"lib/bandit/http1/socket.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:determine_host_and_port!/4"
},
{
"name": "\u0027Elixir.Bandit.Pipeline\u0027:build_conn!/6"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:resolve_request_target!/2"
},
{
"name": "\u0027Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket\u0027:validate_request_line!/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "6ea80210137b3f69caf65f67398934259dc365d0",
"status": "affected",
"version": "0e3edda0edf6322e9164b827c6d3ddecd080ff2e",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://good.example@evil.example/x HTTP/1.1 with a valid Host header yields a conn.host of good.example@evil.example, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port.\n\nApplications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host.\n\nThis issue affects bandit: from 0.6.0 before 1.13.0."
}
],
"id": "CVE-2026-105660",
"lastModified": "2026-10-15T19:17:16.290",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
},
"published": "2026-10-15T19:17:16.290",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-105660.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/commit/0e3edda0edf6322e9164b827c6d3ddecd080ff2e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/commit/6ea80210137b3f69caf65f67398934259dc365d0"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-v53v-9hvg-37jf"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105660"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1286"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.