Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.

do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.

This issue affects bandit: from 0.3.1 before 1.14.1.
Published: 2026-10-28
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an unbounded allocation of memory in Bandit’s HTTP/2 request body reader. An unauthenticated remote attacker can send an arbitrary number of 1‑byte DATA frames, each of which is stored as a separate list cell and binary term, causing the process memory to grow without limits. This results in a denial of service by exhausting server memory and affects only routes that invoke Plug.Parsers.

Affected Systems

Bandit (mtrudel:bandit) is affected across all releases from 0.3.1 up to, but not including, 1.14.1. The product uses Plug for routing, and the issue impacts any route that parses request bodies on any host running these versions.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. Exploitation does not require authentication and relies on sending HTTP/2 requests with many small frames. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so risk assessment is based on the inherent characteristics and CVSS. The likely attack vector is remote network access to the HTTP/2 interface and exploitation of Plug.Parsers.

Generated by OpenCVE AI on October 28, 2026 at 14:20 UTC.

Remediation

Vendor Workaround

From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable body reader never runs.

OpenCVE Recommended Actions

  • Upgrade to Bandit 1.14.1 or newer to receive the fix.
  • If upgrading is not immediately possible, configure Bandit to disable HTTP/2 by setting http_2_options: [enabled: false] so that the vulnerable body reader is never invoked.
  • Review and, if necessary, adjust routes that use Plug.Parsers to limit request body size or remove unnecessary body parsing to reduce memory consumption.

Generated by OpenCVE AI on October 28, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.
Title HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-770
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-28T13:26:25.372Z

Reserved: 2026-10-25T12:30:01.606Z

Link: CVE-2026-116078

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T14:16:58.153

Modified: 2026-10-28T14:16:58.153

Link: CVE-2026-116078

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T14:30:22Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling