Mat Trudel

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Client-supplied URI scheme trusted without transport verification in bandit