CVE-2026-116078

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.1 through 1.14.0

Description An unauthenticated remote attacker can exhaust server memory by sending a request body composed of numerous 1-byte DATA frames. The issue occurs in the HTTP/2 request body reader where the do read data/5 function in lib/bandit/http2/stream.ex stores every DATA frame payload as an individual list element until the read operation returns. Because the :length option of read body/2 tracks the total number of bytes rather than the number of frames, a high volume of small frames creates significant memory overhead per byte. This effect is amplified when frames are interleaved across up to 500 concurrent streams per connection. This issue affects any route where the Plug reads the request body, including those using Plug.Parsers for POST, PUT, and PATCH requests.

Recommendations Update bandit to version 1.14.1 or later. As a temporary workaround for versions 0.7.0 and later, disable HTTP/2 by setting http 2 options: [enabled: false].