Live › vulnerability › CVE-2026-116078
Go to dashboardBandit, an Elixir HTTP server, stores each HTTP/2 DATA frame payload as a separate list element when reading a request body, so many tiny frames across many streams use far more memory than the body size. An unauthenticated remote attacker can exhaust server memory and crash or stall the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Applications running bandit from 0.3.1 up to but not including 1.14.1 that serve HTTP/2 and have routes whose Plug reads the request body, including any route behind Plug.Parsers. Services that only serve HTTP/1.1 or do not read request bodies are less exposed, though the sources do not state this explicitly.
No product ranges from the sources yet.
mix deps | grep bandit or check mix.lock for the bandit version in use1.14.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.
This issue affects bandit: from 0.3.1 before 1.14.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116078")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.