CVE-2026-39803
HighSummary
CVE-2026-39803 in mtrudel bandit has a resource allocation without limits vulnerability that allows unauthenticated remote denial of service via memory exhaustion. The do_read_chunked_data!/5 function does not cap the size of buffered data, leading to memory overflow.
Risk Assessment
An attacker can exploit this vulnerability to remotely disable the service, potentially causing downtime and loss of availability for users.
Recommendation
It is recommended to update to the latest version of mtrudel bandit that fixes this vulnerability and to implement limits on the size of incoming HTTP requests.
Other vulnerabilities in mtrudel bandit
See all- CVE-2026-39806High
CVE-2026-39806 vulnerability in mtrudel bandit allows remote denial of service via worker process exhaustion. The issue occurs in the do_read_chunked_data!/5 function, which does not terminate correctly when trailer fields are present in chunked requests.
- CVE-2026-39804High
CVE-2026-39804 vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion when permessage-deflate compression is enabled in WebSocket. An unauthenticated attacker can send a specially crafted frame, leading to an out-of-memory kill.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response. Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the