hj/pleroma - Forgejo

hj/pleroma

1 line

67 B

Text

Raw Normal View History

Sec: Bump bandit to version 1.12.5 Fixes: - EEF-CVE-2026-74836 (HIGH) aka: CVE-2026-74836, GHSA-xj8g-532w-jv94 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit https://osv.dev/vulnerability/EEF-CVE-2026-74836 - EEF-CVE-2026-75484 (MEDIUM) aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit https://osv.dev/vulnerability/EEF-CVE-2026-75484

2026-09-08 21:28:37 +02:00

Update bandit to version 1.12.5 to fix an HTTP/2 DoS vulnerability