CVE-2026-105660
Received Received - Intake

Improper Input Validation in Bandit Web Server

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: EEF

Description
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates the Host header and answers 400 when it is malformed, but when the request target carries its own authority that authority takes precedence, as RFC 9112 requires, and Bandit.Pipeline.determine_host_and_port!/4 in lib/bandit/pipeline.ex passes it to the application unchecked. A request line such as GET http://good.example@evil.example/x HTTP/1.1 with a valid Host header yields a conn.host of good.example@evil.example, and the same path admits NUL, DEL and non-ASCII bytes, invalid IP literals and ports outside 1..65535. The HTTP/1.0 clause needs no Host header at all, and CONNECT places the unparsed port string in conn.port. Applications that build absolute URLs from conn.host, such as through Plug.Conn.request_url/1 or Phoenix URL helpers, emit links whose authority the attacker chose. Message framing is unaffected, and no CR or LF can reach conn.host. This issue affects bandit: from 0.6.0 before 1.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-105660
EUVD
EUVD-2026-102317

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.6.0
mtrudel bandit 0e3edda0edf6322e9164b827c6d3ddecd080ff2e

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105660 is an improper input validation flaw in the Bandit web server (Erlang) affecting versions 0.6.0 to 1.13.0. It allows unauthenticated remote attackers to manipulate the conn.host and conn.port values by crafting HTTP/1 requests with malformed authority fields in the request target. Bandit validates the Host header but fails to validate the request-target authority, which RFC 9112 requires to take precedence. This bypasses security checks and enables attackers to set conn.host to arbitrary values including invalid characters, non-ASCII bytes, or ports outside the valid range.

Detection Guidance

To detect this vulnerability, inspect HTTP/1.1 request logs for malformed request targets containing absolute-form or authority-form authorities (e.g., GET http://good.example@evil.example/x HTTP/1.1). Check if applications using Bandit versions < 1.13.0 log conn.host values with invalid characters, non-ASCII bytes, or ports outside 1-65535. Use network monitoring tools to identify requests bypassing Host header validation.

Impact Analysis

This vulnerability can impact applications that rely on conn.host or conn.port for security-sensitive operations. Attackers could manipulate these values to generate malicious URLs, potentially leading to phishing attacks or other security breaches. For example, if an application uses conn.host to construct password-reset or verification links, an attacker could redirect users to a malicious site. The impact is limited to applications that derive URLs from these fields.

Mitigation Strategies

Upgrade Bandit to version 1.13.0 or later to apply the patch. If upgrading is not immediately possible, implement a reverse proxy to reject absolute-form request targets or add a plug to validate conn.host and conn.port before use. Avoid relying on these values for security-sensitive operations like URL construction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart