pleroma/changelog.d/bandit-1.13.1.security at b4a3e8436dd762bbdb4f0c2b821921b907ae9fbd - hj/pleroma - Forgejo

hj/pleroma

Phantasm b4a3e8436d

Sec: Update bandit to version 1.13.1

Fixes:
  bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
    aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105659

  bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
    aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
    Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105660

2026-10-21 11:27:55 +02:00

1 line

105 B

Text

Raw Blame History

Update bandit to version 1.13.1 resolving a stuck process and unvalidated HTTP/1 headers vulnerabilities