Jonatan Männchen / EEF

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Unbounded response body buffering and decompression in hackney