CVE-2026-105660: CWE-1286 Improper Validation of Syntactic Correctness of Input in mtrudel bandit

The vulnerability arises because bandit validates the Host header and rejects malformed values with a 400 response, but when the HTTP request target carries its own authority (per RFC 9112), that authority takes precedence and is passed unchecked to the application via Bandit.Pipeline.determine_host_and_port!/4. This allows an attacker to craft request lines such as 'GET http://[email protected]/x HTTP/1.1' that result in conn.host being set to '[email protected]', including invalid characters such as NUL, DEL, non-ASCII bytes, invalid IP literals, and ports outside the valid range 1..65535. This affects applications that build absolute URLs from conn.host, potentially causing them to emit links with attacker-controlled authority. The issue affects bandit versions >=0.6.0 and <1.13.0.

An unauthenticated remote attacker can manipulate the conn.host and conn.port values used by the application, potentially causing it to generate URLs with attacker-controlled authority components. This could lead to security issues such as phishing or redirect attacks if these URLs are used in responses or logs. However, message framing is not affected, and no carriage return or line feed characters can reach conn.host, limiting injection vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or fix link is provided, users should monitor official mtrudel bandit advisories for updates and apply any forthcoming patches that address this input validation issue. Until then, avoid relying on conn.host for security-sensitive decisions or URL generation without additional validation.