CVE-2026-39806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39806", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-04-07T12:28:54.916Z", "datePublished": "2026-05-13T13:36:17.806Z", "dateUpdated": "2026-05-27T15:41:42.286Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.11.1", "status": "affected", "version": "1.6.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "ae3520dfdbfab115c638f8c7f6f6b805db34e1ab", "status": "affected", "version": "e73e379ab59840e8561b5730878f16e29ab06217", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.11.1", "versionStartIncluding": "1.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.<p><tt>'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5</tt> in <tt>lib/bandit/http1/socket.ex</tt> terminates only when the last-chunk line <tt>0\\r\\n</tt> is followed immediately by the empty trailer line <tt>\\r\\n</tt>. RFC 9112 \u00a77.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative <tt>to_read</tt>, calls <tt>read_available!/2</tt>, receives <tt>&lt;&lt;&gt;&gt;</tt> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.</p><p>A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.</p><p>This issue affects bandit: from 1.6.1 before 1.11.1.</p>"}], "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.\n\n'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\\r\\n is followed immediately by the empty trailer line \\r\\n. RFC 9112 \u00a77.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.\n\nA handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.\n\nThis issue affects bandit: from 1.6.1 before 1.11.1."}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:42.286Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-39806.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39806"}, {"tags": ["patch"], "url": "https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"}], "source": {"discovery": "EXTERNAL"}, "title": "HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T14:36:21.650529Z", "id": "CVE-2026-39806", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:36:34.475Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39806", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:36:21.650529Z"}}}], "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:35:57.553Z"}}], "cna": {"title": "HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "product": "bandit", "versions": [{"status": "affected", "version": "1.6.1", "lessThan": "1.11.1", "versionType": "semver"}], "packageURL": "pkg:hex/bandit", "packageName": "bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}]}, {"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "product": "bandit", "versions": [{"status": "affected", "version": "e73e379ab59840e8561b5730878f16e29ab06217", "lessThan": "ae3520dfdbfab115c638f8c7f6f6b805db34e1ab", "versionType": "git"}], "packageURL": "pkg:github/mtrudel/bandit", "packageName": "mtrudel/bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}]}], "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-39806.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-39806", "tags": ["related"]}, {"url": "https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.\n\n'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\\r\\n is followed immediately by the empty trailer line \\r\\n. RFC 9112 \u00a77.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.\n\nA handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.\n\nThis issue affects bandit: from 1.6.1 before 1.11.1.", "supportingMedia": [{"type": "text/html", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.<p><tt>'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5</tt> in <tt>lib/bandit/http1/socket.ex</tt> terminates only when the last-chunk line <tt>0\\r\\n</tt> is followed immediately by the empty trailer line <tt>\\r\\n</tt>. RFC 9112 \u00a77.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative <tt>to_read</tt>, calls <tt>read_available!/2</tt>, receives <tt>&lt;&lt;&gt;&gt;</tt> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.</p><p>A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.</p><p>This issue affects bandit: from 1.6.1 before 1.11.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.11.1", "versionStartIncluding": "1.6.1"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:42.286Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39806", "state": "PUBLISHED", "dateUpdated": "2026-05-27T15:41:42.286Z", "dateReserved": "2026-04-07T12:28:54.916Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-13T13:36:17.806Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.11.1", "status": "affected", "version": "1.6.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP1.Socket'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/http1/socket.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "ae3520dfdbfab115c638f8c7f6f6b805db34e1ab", "status": "affected", "version": "e73e379ab59840e8561b5730878f16e29ab06217", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C7F13C2-7993-4309-BCAE-8548A08F9D5E", "versionEndExcluding": "1.11.1", "versionStartIncluding": "1.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.\n\n'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\\r\\n is followed immediately by the empty trailer line \\r\\n. RFC 9112 \u00a77.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.\n\nA handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.\n\nThis issue affects bandit: from 1.6.1 before 1.11.1."}, {"lang": "es", "value": "\u2019Vulnerabilidad\u2019 de bucle con condici\u00f3n de salida inalcanzable (\u2019bucle infinito\u2019) en mtrudel bandit permite la \u2019denegaci\u00f3n de servicio\u2019 remota no \u2019autenticada\u2019 a trav\u00e9s del agotamiento del proceso de trabajador.\n\n\u2019Elixir.Bandit.HTTP1.Socket\u2019:do_read_chunked_data!/5 en lib/bandit/http1/socket.ex termina solo cuando la l\u00ednea del \u00faltimo fragmento 0\\r\\n es seguida inmediatamente por la l\u00ednea de tr\u00e1iler vac\u00eda \\r\\n. RFC 9112 \u00a77.1.2 permite cero o m\u00e1s campos de tr\u00e1iler entre ellos. Cuando los tr\u00e1ilers est\u00e1n presentes, ninguna de las cl\u00e1usulas de coincidencia encaja: el brazo comod\u00edn calcula un to_read negativo, llama a read_available!/2, recibe <<>> por tiempo de espera, y se recurre en cola con estado inalterado. El proceso de trabajador queda anclado durante la vida \u00fatil de la conexi\u00f3n TCP.\n\nUn pu\u00f1ado de conexiones concurrentes enviando solicitudes fragmentadas conformes a RFC con campos de tr\u00e1iler es suficiente para agotar el pool de trabajadores de Bandit y dejar al \u2019servidor\u2019 sin respuesta a todo el tr\u00e1fico posterior. No se requiere \u2019autenticaci\u00f3n\u2019, encabezados especiales ni una carga \u00fatil grande. Proxies como NGINX y HAProxy reenv\u00edan leg\u00edtimamente solicitudes con tr\u00e1iler, por lo que los \u2019servidores\u2019 detr\u00e1s de dichos proxies pueden verse afectados sin ninguna participaci\u00f3n maliciosa del \u2019cliente\u2019.\n\nEste problema afecta a bandit: desde 1.6.1 antes de 1.11.1."}], "id": "CVE-2026-39806", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39806", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T14:36:21.650529Z", "version": "2.0.3"}}]}, "published": "2026-05-13T14:17:35.700", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-39806.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39806"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.1,1.11.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e73e379ab59840e8561b5730878f16e29ab06217,ae3520dfdbfab115c638f8c7f6f6b805db34e1ab)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "bandit", "vendor": "mtrudel"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.1,1.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e73e379ab59840e8561b5730878f16e29ab06217,ae3520dfdbfab115c638f8c7f6f6b805db34e1ab)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}], "created": "2026-05-13T16:00:17.843110+00:00", "updated": "2026-05-13T18:30:46.209056+00:00", "vendors": ["mtrudel", "mtrudel$PRODUCT$bandit"]}