hj/pleroma - Forgejo

hj/pleroma

1 line

105 B

Text

Raw Normal View History

Sec: Update bandit to version 1.13.1 Fixes: bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH) aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit https://osv.dev/vulnerability/EEF-CVE-2026-105659 bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM) aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit https://osv.dev/vulnerability/EEF-CVE-2026-105660

2026-10-21 11:21:52 +02:00

Update bandit to version 1.13.1 resolving a stuck process and unvalidated HTTP/1 headers vulnerabilities