hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sec: Update bandit to version 1.13.1

Browse source 
Fixes:
  bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
    aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105659

  bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
    aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
    Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105660
This commit is contained in:
Phantasm 2026-10-21 11:21:52 +02:00
commit b4a3e8436d
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/bandit-1.13.1.security Normal file
View file

@ -0,0 +1 @@
Update bandit to version 1.13.1 resolving a stuck process and unvalidated HTTP/1 headers vulnerabilities