CVE-2026-39805
Description
A flaw was found in Bandit, an HTTP server. This vulnerability allows for HTTP request smuggling due to the server's inconsistent handling of duplicate Content-Length headers in HTTP requests. An unauthenticated attacker can exploit this by sending a specially crafted request. If Bandit is operating behind a proxy that interprets these headers differently, the attacker can bypass security mechanisms like Web Application Firewalls (WAFs), access controls, and rate limiting, potentially leading to unauthorized actions or access.
Statement
This IMPORTANT HTTP request smuggling vulnerability in Bandit allows attackers to bypass security controls when the server sits behind certain proxies. Exploitation requires high complexity (specific proxy behavior) but no authentication. Impact is high to confidentiality and integrity through bypassed security mechanisms. Affects Bandit versions before 1.11.0.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
