[joshlarson]

No ticket. In response to the following advisories:

bandit 1.13.0 VULNERABLE!

  EEF-CVE-2026-109584 (HIGH)
  aka: CVE-2026-109584, GHSA-7gfj-7gvq-3xqj
  HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-109584

  EEF-CVE-2026-114216 (MEDIUM)
  aka: CVE-2026-114216, GHSA-w5wc-g2hc-g7m2
  Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-114216

  EEF-CVE-2026-115269 (HIGH)
  aka: CVE-2026-115269, GHSA-p2qv-vx88-385x
  HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-115269

  EEF-CVE-2026-116078 (HIGH)
  aka: CVE-2026-116078, GHSA-pxjf-g536-7r93
  HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-116078

  EEF-CVE-2026-108529 (HIGH)
  aka: CVE-2026-108529, GHSA-j363-h72p-296m
  SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-108529

  EEF-CVE-2026-108525 (HIGH)
  aka: CVE-2026-108525, GHSA-c3g7-2pg5-qvwh
  HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-108525

  EEF-CVE-2026-110314 (MEDIUM)
  aka: CVE-2026-110314, GHSA-2v5v-8f9v-xh85
  WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-110314

  EEF-CVE-2026-110499 (HIGH)
  aka: CVE-2026-110499, GHSA-47x4-3fxf-82fr
  Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-110499

  EEF-CVE-2026-111101 (HIGH)
  aka: CVE-2026-111101, GHSA-jwh3-j29h-qfmw
  HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-111101

  EEF-CVE-2026-111103 (HIGH)
  aka: CVE-2026-111103, GHSA-2238-pgfc-w82m
  HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-111103

  EEF-CVE-2026-113436 (HIGH)
  aka: CVE-2026-113436, GHSA-29cr-8477-rg6r
  Quadratic bignum parsing of Content-Length and Host port values in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-113436

  EEF-CVE-2026-114213 (HIGH)
  aka: CVE-2026-114213, GHSA-cpx7-qf6w-jc63
  WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
  https://osv.dev/vulnerability/EEF-CVE-2026-114213

hackney 4.7.4 VULNERABLE!

  EEF-CVE-2026-112880 (LOW)
  aka: CVE-2026-112880
  CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
  https://osv.dev/vulnerability/EEF-CVE-2026-112880

  EEF-CVE-2026-97200 (HIGH)
  aka: CVE-2026-97200
  Unbounded response body buffering and decompression in hackney
  https://osv.dev/vulnerability/EEF-CVE-2026-97200

  EEF-CVE-2026-115700 (MEDIUM)
  aka: CVE-2026-115700
  SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
  https://osv.dev/vulnerability/EEF-CVE-2026-115700

  EEF-CVE-2026-115693 (CRITICAL)
  aka: CVE-2026-115693
  Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
  https://osv.dev/vulnerability/EEF-CVE-2026-115693

  EEF-CVE-2026-113440 (MEDIUM)
  aka: CVE-2026-113440
  HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
  https://osv.dev/vulnerability/EEF-CVE-2026-113440

plug_crypto 2.2.0 VULNERABLE!

  EEF-CVE-2026-105963 (MEDIUM)
  aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
  Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
  https://osv.dev/vulnerability/EEF-CVE-2026-105963