The vulnerable chunked body reader in Bandit allocates memory without bounds when processing HTTP/1.1 requests composed of many 1‑byte chunks. A single 48 MB series of 1‑byte chunks can inflate a handler process to roughly 500 MB and consume several seconds of CPU time, effectively exhausting server resources. Although the route does not normally read the request body, the HTTP/1.1 protocol forces the reader to parse every chunk, so the attacker can trigger the issue without authentication or special privileges.

This flaw affects the Bandit HTTP server from release 0.1.0 up through 1.13.99, including all 1.13.x and 0.xx.x versions. The product is produced by mtrudel under the name Bandit and is available via its GitHub repository.

The CVSS score of 8.7 indicates a high impact vulnerability. The EPSS score is currently undocumented, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote attacker sending a crafted HTTP/1.1 request with many tiny chunks. The exploit would require the server to accept HTTP/1.1 traffic; disabling HTTP/1.1 or limiting request parsing would mitigate exploitation. No public exploit is known, but the high severity warrants immediate attention.