A vulnerability labeled as critical has been found in mtrudel bandit up to 1.10.x. Affected by this issue is the function Elixir.bandit.Headers:get_content_length in the library lib/bandit/headers.ex of the component HTTP Request Handler. Executing a manipulation can lead to http request smuggling. This vulnerability is registered as CVE-2026-39805. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.
| Vendor | Product | Versions |
|---|---|---|
| mtrudel | bandit | 0, 0 |
Updated severity to CRITICAL, changed exploit availability to false, and noted that the vulnerability is actively exploited.
Initial creation
