The vulnerability lies in Bandit’s HTTP/1 chunked body reader where it ignores the caller‑supplied maximum length when processing Transfer‑Encoding: chunked requests. As a result, each received chunk is buffered into an iolist and later materialized as a single binary, regardless of any limit set by callers such as Plug.Parsers. Consequently, a request exceeding the configured bound always results in a full in‑memory copy, which can exhaust the BEAM process’s memory and trigger the operating system OOM killer, denying service to the application. The flaw is a classic example of Allocation of Resources Without Limits (CWE‑770).

The affected product is Bandit by mtrudel, version range 1.4.0 through 1.11.0 inclusive. Any application that uses Bandit as an HTTP server – for example typical Phoenix endpoints – is vulnerable because the bug resides in the core HTTP socket handling code and is exercised before routing or authentication.

The CVSS score of 8.7 indicates a high severity denial of service risk. EPSS data is not available, but the lack of authentication or routing prerequisites means an attacker can trigger the issue by sending a simple chunked POST to any path. The vulnerability is not listed in the CISA KEV catalog, yet the memory exhaustion mechanism can still cause system‑wide outage. Attackers can abuse this flaw by sending a large, chunked body that forces the BEAM process to allocate an ever‑growing buffer, leading to an OOM condition that terminates the process.