EUVD-2026-26714
GHSA-375f-4r2h-f99j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections.
'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this function. Over a plaintext TCP connection, a client can declare https and Bandit will set conn.scheme = :https even though no TLS was negotiated.
Downstream Plug consumers that branch on conn.scheme are silently misled: Plug.SSL's already-secure branch skips its HTTP→HTTPS redirect, cookies emitted with secure: true are sent over plaintext, audit logs record requests as having arrived over HTTPS, and CSRF/SameSite gating may make incorrect decisions.
This issue affects bandit: from 1.0.0 before 1.11.0.
AnalysisAI
Transport-state spoofing in Bandit 1.0.0 through 1.10.x allows unauthenticated remote attackers to forge HTTPS connections over plaintext HTTP by supplying a malicious URI scheme in HTTP/1.1 absolute-form request targets or HTTP/2 :scheme pseudo-headers. The vulnerable determine_scheme/2 function returns client-supplied scheme values verbatim, causing downstream Plug middlewares to make incorrect security decisions: Plug.SSL skips HTTP→HTTPS redirects, secure cookies are transmitted unencrypted, and CSRF/SameSite protections may be bypassed. CVSS 6.3 (network-accessible, low complexity). Vendor patch available (version 1.11.0+).
Technical ContextAI
Bandit is an HTTP server for the Elixir/Erlang ecosystem built on Plug. The vulnerable code path is in lib/bandit/pipeline.ex:determine_scheme/2, which processes HTTP request metadata to populate the Plug connection struct's scheme field. In HTTP/1.1, clients can send absolute-form request targets (RFC 9110 Section 7.2) like GET https://victim/path HTTP/1.1 over plaintext TCP; similarly, HTTP/2 allows clients to set the :scheme pseudo-header to any value. The original implementation extracted and returned this client-controlled scheme directly without validating against the underlying transport's TLS status (the secure? boolean flag representing whether the socket negotiated TLS). This violates CWE-807 (Reliance on Untrusted Inputs in a Security Decision) by trusting attacker-controlled input where a security-critical decision (scheme := https vs http) should depend only on cryptographic transport properties. Downstream Plug consumers-including Plug.SSL middleware and applications performing conn.scheme-based branching-inherit this false signal, leading to logic errors in cookie security, redirect logic, logging, and CSRF token validation.
RemediationAI
Vendor-released patch: upgrade to Bandit version 1.11.0 or later. The patch refactors determine_scheme/2 to accept only the secure? boolean flag (representing the transport's TLS status) and discards the client-supplied request_target scheme parameter entirely, returning 'https' if secure?=true and 'http' otherwise. No upgrade path exists for versions prior to 1.0.0. Workarounds: For users unable to upgrade immediately, deploy Bandit behind a TLS-terminating reverse proxy (nginx, HAProxy) that strips or validates the :scheme pseudo-header and ensures the origin server observes only the proxy's own scheme header, preventing client spoofing. Additionally, configure Plug.SSL with explicit assume_secure: true if behind a trusted proxy, forcing all downstream logic to treat connections as HTTPS regardless of conn.scheme-note this disables the HTTP→HTTPS redirect and should only be used with a proxy that enforces TLS to clients. Audit downstream Plug middleware (especially custom authentication and cookie-handling code) for conn.scheme-based branches and add explicit transport-based checks using the socket's underlying state rather than relying on the scheme field. None of these workarounds fully eliminate the vulnerability; upgrade is the only complete fix.
HTTP request smuggling in mtrudel bandit before version 1.11.0 allows unauthenticated attackers to bypass edge security
Unauthenticated remote denial of service in mtrudel Bandit (Elixir HTTP server) versions 1.6.1 through 1.11.0 lets any c
CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassem
Unauthenticated remote denial of service in Bandit (the Elixir HTTP/1 web server for Phoenix/Plug applications) versions
Memory exhaustion in Bandit WebSocket server (versions 0.5.0 through 1.10.x) allows unauthenticated remote attackers to
Memory exhaustion in Bandit WebSocket server (versions 0.5.9 through 1.10.x) allows unauthenticated remote attackers to
Denial of service in mtrudel bandit via HTTP/2 frame deserialization allows unauthenticated remote attackers to exhaust
Share
External POC / Exploit Code
Leaving vuln.today