Live › vulnerability › CVE-2026-111101
Go to dashboardBandit, an Elixir HTTP server, has no limit on the number of chunks in a chunked request body, so each 1-byte chunk adds memory and CPU cost. An unauthenticated remote attacker can send a body of many tiny chunks and exhaust server memory and CPU, even if the route never reads the body.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications that serve HTTP/1.1 traffic directly with Bandit from versions 0.1.0 up to but not including are exposed, since the flaw is in the chunked body reader that runs for every request on keep-alive connections. Systems behind a proxy that rejects or normalizes chunked bodies may be less exposed, but the sources do not confirm this.
1.14.0No product ranges from the sources yet.
mix.lock or with mix deps | grep bandit{:bandit, in mix.exs to confirm the dependency is present1.14.0 or later in mix.exs, then run mix deps.update banditEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.
The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.
This issue affects bandit: from 0.1.0 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.