Mat Trudel

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit