All issues

Search results

Add tests for untested configuration options

Status: Open.

#644 In mtrudel/bandit;

· mpettibone opened on Aug 11, 2026

Do not duplicate an existing vary: accept-encoding header

Status: Open.

#643 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Match the weak-etag prefix W/ explicitly

Status: Open.

#642 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Use PROTOCOL_ERROR for a zero WINDOW_UPDATE increment

Status: Open.

#641 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Reject signed or malformed chunk sizes with a 400 instead of crashing

Status: Open.

#640 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Honor the close/keep-alive token inside a comma-separated Connection header

Status: Open.

#639 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Initialize the per-stream receive window from the advertised initial_window_size

Status: Open.

#638 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Reject requests carrying multiple Transfer-Encoding headers

Status: Open.

#637 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Reject send_file ranges past EOF instead of emitting a negative Content-Length

Status: Open.

#636 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Return FRAME_SIZE_ERROR for HEADERS/DATA frames too short for their flags

Status: Open.

#635 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Avoid O(n^2) reads when decoding chunked request bodies

Status: Open.

#634 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026

Reject compressed WebSocket control frames regardless of the fin bit

Status: Open.

#633 In mtrudel/bandit;

· mpettibone opened on Aug 10, 2026