mtrudel has 13 CVEs on record. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 13. The median CVSS is 8.7 (high). None have a confirmed exploitation report. The most common weakness class is CWE-770 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —
- Last 90 days
- 13 prev 0
Weakness classes
Products
- bandit 13
Worst active — by depth score
CVE-2026-105659High· 8.7Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames60CVE-2026-105660Medium· 6.9Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…50CVE-2026-115269High· 8.7HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit48CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit48CVE-2026-113436High· 8.7Quadratic bignum parsing of Content-Length and Host port values in Bandit48
mtrudel vulnerabilities
CVEs affecting mtrudel, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-114216Medium· 6.3Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end p…
CVE-2026-115269High· 8.7HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTIN…
CVE-2026-110314Medium· 6.3WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames…
CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte con…
CVE-2026-109584High· 8.7HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. …
CVE-2026-108525High· 8.7HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window.…
CVE-2026-113436High· 8.7Quadratic bignum parsing of Content-Length and Host port values in Bandit
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of …
CVE-2026-110499High· 8.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEA…
CVE-2026-111103High· 8.2HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of whic…
CVE-2026-108529High· 8.7SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker ope…
CVE-2026-111101High· 8.7HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte ch…
CVE-2026-105660Medium· 6.9PoCImproper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 abs…
CVE-2026-105659High· 8.7PoCUncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the conn…