CVE-2026-111101

Name of the Vulnerable Software and Affected Versions bandit versions 0.1.0 through 1.13.x

Description An unauthenticated remote attacker can exhaust server memory and CPU resources by sending a request body composed of numerous 1-byte chunks. The issue exists in the HTTP/1.1 chunked body reader within lib/bandit/http1/socket.ex, which stores every chunk as an individual list cell and binary term until they are joined by the IO.iodata to binary/1 function. Because the :length option of the read body/2 function only counts data bytes and does not limit the total number of chunks, small chunks consume significantly more memory than their actual payload. This can occur even if the route does not explicitly read the body, as the ensure completed/1 function drains unread bodies on keep-alive connections.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround for versions 0.7.0 and later, if all clients and proxies support HTTP/2, disable HTTP/1 by setting http 1 options: [enabled: false] to prevent the chunked body reader from executing.