{"id":"CVE-2026-116078","kind":"vulnerability","aliases":["CVE-2026-116078"],"related":[],"title":"Bandit: HTTP/2 body reader lets remote clients exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.\n\ndo_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.\n\nThis issue affects bandit: from 0.3.1 before 1.14.1.","summary":"Bandit, an Elixir HTTP server, stores each HTTP/2 DATA frame payload as a separate list element when reading a request body, so many tiny frames across many streams use far more memory than the body size. An unauthenticated remote attacker can exhaust server memory and crash or stall the service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","http2","package","phoenix","self-hosted"],"not_affected_if":["bandit-1.14.1-or-later","http1-only"],"how_to_check":"- Run `mix deps | grep bandit` or check `mix.lock` for the bandit version in use\n- Confirm HTTP/2 is served by Bandit (the endpoint accepts HTTP/2 connections)","fix":"- Upgrade bandit to `1.14.1` or later\n- Until upgraded, unknown whether disabling HTTP/2 or limiting concurrent streams is a workable mitigation","status":"open","published_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","triaged_at":"2026-10-28T14:34:20+00:00","updated_at":"2026-10-28T14:34:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T14:34:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bandit to `1.14.1` or later\n- Until upgraded, unknown whether disabling HTTP/2 or limiting concurrent streams is a workable mitigation","reach":"internet","title":"Bandit: HTTP/2 body reader lets remote clients exhaust server memory","impact":"medium","summary":"Bandit, an Elixir HTTP server, stores each HTTP/2 DATA frame payload as a separate list element when reading a request body, so many tiny frames across many streams use far more memory than the body size. An unauthenticated remote attacker can exhaust server memory and crash or stall the service.","category":"package","nicknames":[],"who_cares":["elixir","phoenix","bandit","http2","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated remote client exhausts server memory, crashing the service","analyst_note":"Confirm the HTTP/2 default and whether a workaround exists short of upgrading, using the NVD entry and the bandit repository advisory.","how_to_check":"- Run `mix deps | grep bandit` or check `mix.lock` for the bandit version in use\n- Confirm HTTP/2 is served by Bandit (the endpoint accepts HTTP/2 connections)","needs_analyst":true,"not_affected_if":["bandit-1.14.1-or-later","http1-only"],"who_is_affected":"Applications running bandit from 0.3.1 up to but not including 1.14.1 that serve HTTP/2 and have routes whose Plug reads the request body, including any route behind Plug.Parsers. Services that only serve HTTP/1.1 or do not read request bodies are less exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":3543,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116078':13A,16A '-2026':12A,15A '0.3.1':220C '1':108C,146C '1.14.1':222C '100':184C '25':187C '40':189C '5':196C '500':165C 'across':50B,162C 'affect':208C,217C 'alloc':75C 'allow':92C 'arriv':178C 'attack':64B,96C 'bandit':1A,17B,25B,91C,218C 'behind':213C 'binari':155C 'bodi':3A,45B,59B,87C,104C,138C,144C,206C 'body/2':136C 'byte':109C,139C,147C,158C 'cell':152C 'client':7A 'concurr':166C 'connect':169C 'consum':173C 'cost':149C 'count':137C 'crash':70B 'cve':11A,14A 'data':33B,110C,119C 'data/5':114C 'element':40B,126C 'elixir':18B,27B 'everi':118C 'exhaust':8A,66B,98C 'far':54B 'frame':34B,49B,111C,120C,141C,148C,161C,175C 'held':186C 'host':24B 'http':28B 'http/2':2A,32B,85C 'http2':19B 'includ':210C 'interleav':159C 'issu':216C 'keep':117C,170C 'length':132C 'let':5A 'lib/bandit/http2/stream.ex':116C 'limit':79C 'list':39B,125C,151C 'mani':47B,51B,107C 'mb':197C 'memori':10A,56B,68B,100C,194C 'mib':190C 'mtrudel':90C 'option':133C 'packag':20B 'payload':35B,121C 'per':157C,168C 'phoenix':21B 'plug':202C 'plug.parsers':214C 'process':193C 'read':42B,113C,129C,135C,203C 'reader':4A,88C 'remot':6A,63B,95C 'report':181C 'request':44B,86C,103C,205C 'resourc':77C 'return':130C 'rout':200C,212C 'self':23B 'self-host':22B 'sent':105C,198C 'separ':38B 'server':9A,29B,67B,99C 'servic':74B 'size':60B 'stall':72B 'store':30B 'stream':52B,167C,172C,185C,192C 'term':156C 'test':183C 'throttl':81C 'tini':48B 'unauthent':62B,94C 'use':53B 'via':101C 'vulner':82C 'whose':201C 'without':78C","nicknames":[],"mitigations":[],"who_affected":"Applications running bandit from 0.3.1 up to but not including 1.14.1 that serve HTTP/2 and have routes whose Plug reads the request body, including any route behind Plug.Parsers. Services that only serve HTTP/1.1 or do not read request bodies are less exposed, though the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116078","severity":null,"published_at":"2026-10-28T14:16:58+00:00","modified_at":"2026-10-28T14:16:58+00:00","first_seen_at":"2026-10-28T14:33:22+00:00","fetched_at":"2026-10-28T14:33:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}