CVE-2026-114216

Name of the Vulnerable Software and Affected Versions bandit versions 1.12.4 through 1.13.x

Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, exists in the HTTP/1.1 chunked body reader. This allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy by using a chunk extension containing a bare LF (Line Feed). The issue occurs in the lib/bandit/http1/socket.ex file, where the chunked reader accepts the chunk-size line up to the first CRLF and discards content after the ; character without validating it against the RFC 9112 chunk-ext grammar. Consequently, control bytes like bare LF and bare CR are permitted. If a front-end proxy treats a bare LF as a line ending, it may interpret the stream as a single request, while Bandit interprets it as a separate pipelined request, potentially bypassing proxy access controls. This issue only affects deployments using a front-end proxy that treats a bare LF as a line ending and forwards chunked bodies unchanged.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround, if the front-end proxy supports HTTP/2, disable HTTP/1 by setting http 1 options: [enabled: false] to prevent the chunked body reader from executing.