CVE-2026-114213

In the Elixir bandit library from 0.3.1 before 1.14.1, the HTTP/2 request body reader lacks resource limits, allowing an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. Routes whose Plug reads the request body, including those behind Plug.Parsers, are affected.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Affects bandit from 1.4.0 before 1.14.0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP header integer parser allows an unauthenticated remote attacker to consume server CPU by sending a Content-Length value or Host/:authority port made of thousands of digits. The parser builds the number digit by digit without a length limit, resulting in quadratic time complexity.

An improper cleanup on thrown exception vulnerability in Bandit's HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits by sending multiple frames in a single TCP write, one of which raises a stream error. The connection state rolls back, causing streams to be forgotten and limits to be exceeded.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/1.1 chunked body reader allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The reader keeps every chunk as a separate term without limiting the number of chunks.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. The HPACK encoder table is resized to the client-advertised size without a server-side cap, causing O(N²) CPU cost for N responses.

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.

An improper handling of highly compressed data (data amplification) vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores a large cookie value in the HPACK dynamic table and references it many times, causing excessive memory allocation.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The server walks the entire queue of blocked sends for each frame, resulting in O(n²) list operations for n blocked streams.