{"id":"CVE-2026-111101","kind":"vulnerability","aliases":["CVE-2026-111101"],"related":[],"title":"Bandit: unlimited tiny HTTP chunks let one request exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0.","summary":"Bandit, an Elixir HTTP server, has no limit on the number of chunks in a chunked request body, so each 1-byte chunk adds memory and CPU cost. An unauthenticated remote attacker can send a body of many tiny chunks and exhaust server memory and CPU, even if the route never reads the body.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","package","phoenix","self-hosted"],"not_affected_if":["bandit-1.14.0-or-later"],"how_to_check":"- Check the bandit version in `mix.lock` or with `mix deps | grep bandit`\n- Look for `{:bandit,` in `mix.exs` to confirm the dependency is present","fix":"- Upgrade bandit to `1.14.0` or later in `mix.exs`, then run `mix deps.update bandit`","status":"open","published_at":"2026-10-26T14:16:27+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:11+00:00","updated_at":"2026-10-26T14:32:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bandit to `1.14.0` or later in `mix.exs`, then run `mix deps.update bandit`","reach":"internet","title":"Bandit: unlimited tiny HTTP chunks let one request exhaust server memory","impact":"medium","summary":"Bandit, an Elixir HTTP server, has no limit on the number of chunks in a chunked request body, so each 1-byte chunk adds memory and CPU cost. An unauthenticated remote attacker can send a body of many tiny chunks and exhaust server memory and CPU, even if the route never reads the body.","category":"package","nicknames":[],"who_cares":["elixir","phoenix","bandit","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker exhausts server memory and CPU, causing denial of service","analyst_note":"","how_to_check":"- Check the bandit version in `mix.lock` or with `mix deps | grep bandit`\n- Look for `{:bandit,` in `mix.exs` to confirm the dependency is present","needs_analyst":false,"not_affected_if":["bandit-1.14.0-or-later"],"who_is_affected":"Applications that serve HTTP/1.1 traffic directly with Bandit from versions `0.1.0` up to but not including `1.14.0` are exposed, since the flaw is in the chunked body reader that runs for every request on keep-alive connections. Systems behind a proxy that rejects or normalizes chunked bodies may be less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3532,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111101':14A,17A '-2026':13A,16A '0.1.0':216C '1':45B,114C,169C '1.14.0':218C '48':166C '500':178C '6':183C 'add':48B 'affect':213C 'aliv':200C 'alloc':79C 'allow':96C 'attack':56B,100C 'bandit':1A,18B,25B,95C,214C 'binari':131C 'binary/1':136C 'bodi':42B,60B,78B,91C,110C,195C,206C 'body/2':151C 'byte':46B,115C,155C,170C 'cell':129C 'chunk':5A,37B,40B,47B,64B,90C,116C,118C,124C,145C,158C,171C 'completed/1':203C 'connect':201C 'cost':52B,159C 'count':152C 'cpu':51B,70B,106C,186C 'cve':12A,15A 'data':154C 'drain':204C 'elixir':19B,27B 'ensur':202C 'even':71B 'everi':123C 'exhaust':9A,66B,102C 'far':160C 'grew':172C 'handler':174C 'host':24B 'http':4A,28B 'http/1.1':89C 'io.iodata':134C 'issu':212C 'join':137C 'keep':122C,199C 'keep-al':198C 'length':147C 'let':6A 'lib/bandit/http1/socket.ex':121C 'limit':32B,83C,141C 'list':128C 'made':111C 'mani':62B,113C 'mb':167C,179C 'memori':11A,49B,68B,104C,162C 'mtrudel':94C 'need':191C 'never':75B 'noth':140C 'number':35B,143C 'one':7A,173C 'option':148C 'packag':20B 'payload':165C 'phoenix':21B 'process':175C 'read':76B,150C,193C 'reader':92C,119C,210C 'remot':55B,99C 'request':8A,41B,109C 'resourc':81C 'rout':74B,188C 'self':23B 'self-host':22B 'send':58B 'server':10A,29B,67B,103C 'term':132C 'throttl':85C 'tini':3A,63B,157C 'took':181C 'unauthent':54B,98C 'unlimit':2A 'unread':205C 'via':107C 'vulner':86C 'without':82C","nicknames":[],"mitigations":[],"who_affected":"Applications that serve HTTP/1.1 traffic directly with Bandit from versions `0.1.0` up to but not including `1.14.0` are exposed, since the flaw is in the chunked body reader that runs for every request on keep-alive connections. Systems behind a proxy that rejects or normalizes chunked bodies may be less exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111101","severity":null,"published_at":"2026-10-26T14:16:27+00:00","modified_at":"2026-10-26T14:16:27+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}