---
id: "CVE-2026-116078"
kind: "vulnerability"
aliases: ["CVE-2026-116078"]
title: "Bandit: HTTP/2 body reader lets remote clients exhaust server memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bandit", "elixir", "http2", "package", "phoenix", "self-hosted"]
not_affected_if: ["bandit-1.14.1-or-later", "http1-only"]
published_at: "2026-10-28T14:16:58+00:00"
first_seen_at: "2026-10-28T14:33:22+00:00"
updated_at: "2026-10-28T14:34:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116078", "first_seen_at": "2026-10-28T14:33:22+00:00"}]
---

# Bandit: HTTP/2 body reader lets remote clients exhaust server memory

Bandit, an Elixir HTTP server, stores each HTTP/2 DATA frame payload as a separate list element when reading a request body, so many tiny frames across many streams use far more memory than the body size. An unauthenticated remote attacker can exhaust server memory and crash or stall the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mix deps | grep bandit` or check `mix.lock` for the bandit version in use
- Confirm HTTP/2 is served by Bandit (the endpoint accepts HTTP/2 connections)

## Fix

- Upgrade bandit to `1.14.1` or later
- Until upgraded, unknown whether disabling HTTP/2 or limiting concurrent streams is a workable mitigation

## Timeline

- 2026-10-28T14:33:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116078

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.

do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.

This issue affects bandit: from 0.3.1 before 1.14.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_