Mat Trudel

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Client-supplied URI scheme trusted without transport verification in bandit

WebSocket permessage-deflate inflate has no output-size cap in bandit

WebSocket fragmented message reassembly unbounded in bandit

HTTP/1 chunked body reader ignores length cap in bandit

HTTP/2 frame size limit checked after body is buffered in bandit