Live › vulnerability › CVE-2026-114216
Go to dashboardBandit, an Elixir HTTP server, accepts bare line feeds inside HTTP/1.1 chunked-encoding size lines and ignores the rest of the line. A front-end proxy that splits the line at a bare LF reads a different request boundary, so an unauthenticated attacker can smuggle a second request such as GET /admin past it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications running Bandit from 1.12.4 before 1.14.0 behind a front-end proxy that ends chunk-size lines at a bare LF can be exposed to request smuggling. Bandit deployed without such a proxy in front of it is not affected according to the sources.
No product ranges from the sources yet.
mix deps | grep bandit or check mix.lock for the bandit versionbandit to 1.14.0 or later, per the sources the affected range is from 1.12.4 before 1.14.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.
The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.
This issue affects bandit: from 1.12.4 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114216")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.