CVE-2026-110499

In the Elixir bandit library from 0.3.1 before 1.14.1, the HTTP/2 request body reader lacks resource limits, allowing an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. Routes whose Plug reads the request body, including those behind Plug.Parsers, are affected.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Affects bandit from 1.4.0 before 1.14.0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.

A vulnerability in the Bandit (Elixir) library allows an unauthenticated remote attacker to exhaust server memory via a fragmented WebSocket message made of many 1-byte continuation frames. The fragment reassembly does not limit the number of fragments, so memory usage can greatly exceed the configured limit.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP header integer parser allows an unauthenticated remote attacker to consume server CPU by sending a Content-Length value or Host/:authority port made of thousands of digits. The parser builds the number digit by digit without a length limit, resulting in quadratic time complexity.

An improper cleanup on thrown exception vulnerability in Bandit's HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits by sending multiple frames in a single TCP write, one of which raises a stream error. The connection state rolls back, causing streams to be forgotten and limits to be exceeded.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/1.1 chunked body reader allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The reader keeps every chunk as a separate term without limiting the number of chunks.

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.

An improper handling of highly compressed data (data amplification) vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores a large cookie value in the HPACK dynamic table and references it many times, causing excessive memory allocation.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The server walks the entire queue of blocked sends for each frame, resulting in O(n²) list operations for n blocked streams.