AIKIDO-2026-384578
bandit is vulnerable to Inefficient Algorithmic Complexity
87
High Risk
This Affects:
banditTL;DR
bandit contains an algorithmic complexity denial-of-service (DoS) vulnerability in WebSocket fragment reassembly. An unauthenticated attacker can send a large number of tiny continuation frames, triggering quadratic-time processing during message reassembly and causing excessive CPU consumption. This can exhaust server resources and prevent legitimate clients from being served, even with relatively low network bandwidth.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application serves WebSocket endpoints through bandit.
Background info
bandit is vulnerable to Inefficient Algorithmic Complexity in versions 1.11.0 - 1.12.0.
How to fix this
Upgrade the bandit library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant