CVE-2026-105660

Name of the Vulnerable Software and Affected Versions bandit versions 0.6.0 through 1.12.x

Description An unauthenticated remote attacker can set conn.host and conn.port to values that violate the RFC 3986 host grammar by using the authority of an HTTP/1 absolute-form or authority-form request target. While the software validates the Host header and returns a 400 error if it is malformed, the authority within the request target takes precedence per RFC 9112. The function determine host and port!/4 in lib/bandit/pipeline.ex passes this authority to the application without validation.

This allows the injection of NUL, DEL, and non-ASCII bytes, invalid IP literals, and ports outside the 1..65535 range. Applications that construct absolute URLs using conn.host, such as through Plug.Conn.request url/1 or Phoenix URL helpers, may emit links with an attacker-controlled authority. For CONNECT requests, the unparsed port string is placed in conn.port, which may cause Plug.Conn.request url/1 to raise an error as Plug.Conn.port number/0 expects an integer.

Recommendations Update bandit to version 1.13.0 or later. As a temporary workaround, implement a plug before any code that reads conn.host or conn.port to verify conn.host against an allow-list of served hostnames and ensure conn.port is an integer, returning a 400 response if these checks fail. Avoid deriving absolute URLs from conn.host until these validations are performed.