# CVE-2026-105660: Bandit improper validation of HTTP request authority in input

Source: https://junglewise.ai/threats/cve-2026-105660-improper-validation-of-syntactic-correctness-of-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105660 · Severity: info · Published 2026-10-15

Bandit is an HTTP server library for Elixir applications. An unauthenticated remote attacker can craft HTTP requests with malformed authority fields that bypass validation, allowing them to inject arbitrary hostnames and port numbers into the application. Applications that use these values to construct URLs or redirects may emit links pointing to attacker-controlled destinations, enabling phishing attacks or redirection to malicious sites.

Technologies: [Mtrudel Bandit](https://junglewise.ai/threats/technologies/mtrudel-bandit). Vendors: [Mtrudel](https://junglewise.ai/threats/vendors/mtrudel).

## Quick answers

**Is CVE-2026-105660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105660 being exploited in the wild.

**How severe is CVE-2026-105660?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** Mtrudel Bandit 0.6.0 to before 1.13.0.

**Is there a fix for CVE-2026-105660?** Yes: fixed in Bandit 1.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105660 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105660?** Check whether you run Mtrudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Bandit 1.13.0

## Technical details

The vulnerability exists in Bandit.Pipeline.determine_host_and_port!/4 (lib/bandit/pipeline.ex), which passes the authority component of HTTP/1 absolute-form or authority-form request targets to the application without validating it against RFC 3986 host grammar. While Bandit validates the Host header and rejects malformed values with HTTP 400, it fails to validate the authority in the request line itself, which RFC 9112 states takes precedence. Attackers can inject invalid characters (NUL, DEL, non-ASCII), malformed IP literals, invalid ports, or email-like syntax (e.g., good.example@evil.example) into conn.host and conn.port.

## Affected products

- mtrudel Bandit 0.6.0 to before 1.13.0

## Timeline

- 2026-10-15: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [mtrudel bandit resource exhaustion in HTTP/2 request body reader](https://junglewise.ai/threats/cve-2026-116078-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit HTTP/2 stream resource exhaustion](https://junglewise.ai/threats/cve-2026-115269-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit WebSocket denial of service via fragmented messages](https://junglewise.ai/threats/cve-2026-114213-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit inefficient algorithmic complexity in header parser](https://junglewise.ai/threats/cve-2026-113436-inefficient-algorithmic-complexity-vulnerability-in-the-header)
- [mtrudel bandit HTTP/2 handler resource limit bypass](https://junglewise.ai/threats/cve-2026-111103-improper-cleanup-on-thrown-exception-vulnerability-in-the-http-2)