pleroma/changelog.d/bandit-1.12.5.security at fc91131892bdd9faca3b1f7774422e71d02ce9c9 - hj/pleroma - Forgejo

hj/pleroma

Phantasm 770d827b50

Sec: Bump bandit to version 1.12.5

Fixes:
- EEF-CVE-2026-74836 (HIGH)
  aka: CVE-2026-74836, GHSA-xj8g-532w-jv94
  HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-74836

- EEF-CVE-2026-75484 (MEDIUM)
  aka: CVE-2026-75484, GHSA-x3gh-xhj4-3vq8
  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-75484

2026-09-08 21:28:37 +02:00

1 line

67 B

Text

Raw Blame History

Update bandit to version 1.12.5 to fix an HTTP/2 DoS vulnerability