CVE-2026-116078High· 8.7▾ TwilightAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.
This issue affects bandit: from 0.3.1 before 1.14.1.
bandit >= 0.3.1 < 1.14.1mtrudel/bandit >= c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f < 327bb02ff84171237e1aeff787930debd16155eeRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable body reader never runs.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108525High· 8.7HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
CVE-2026-115269High· 8.7HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-110499High· 8.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
CVE-2026-111101High· 8.7HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-114216Medium· 6.3Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit