Read the docs
TI-2026-81989 Aliases CVE-2026-116078

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Priority HIGH 77CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Bandit, an Elixir HTTP server, is affected from 0.3.1 before 1.14.1. The HTTP/2 request body reader keeps each DATA frame payload as a separate list element, so a body sent as many 1-byte frames costs far more memory than its byte count. An unauthenticated remote attacker can exhaust server memory by interleaving such frames across up to 500 concurrent streams per connection. Only routes whose Plug reads the request body are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Fixed bandit (mtrudel): 1.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mtrudelbandit0.3.1 to before 1.14.11.14.1Patch availableCNA
  • bandit Vendormtrudel Affected 0.3.1 to before 1.14.1 Fixed in 1.14.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*——mtrudel
  • cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:* Versions — — ·mtrudel

Remediation

Upgrade bandit to version 1.14.1 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA bandit (mtrudel) Fixed in 1.14.1

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-116078
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: LOW → HIGH

References

Patch 1

Advisory 1

Other 3

  • TI-2026-74311 Bandit HTTP/2 send timers reset, letting trickles pin stream processes CVSS 4.0HIGH 8.7
  • TI-2026-52571 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit CVSS 4.0HIGH 8.7
  • TI-2026-46780 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit CVSS 4.0HIGH 8.7
  • TI-2026-31007 WebSocket fragmented message reassembly unbounded in bandit CVSS 4.0HIGH 8.7
  • TI-2026-28689 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit CVSS 4.0HIGH 8.7
  • TI-2026-28686 HTTP/1 chunked body reader ignores length cap in bandit CVSS 4.0HIGH 8.7
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences