Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder (CVE-2026-39806) | HOL Guard CVE