The Bandit HTTP/1 chunked decoder contains an infinite loop that is triggered when a request contains HTTP trailer fields. The decoder expects the last chunk indicator line to be directly followed by an empty trailer line, but RFC 9112 allows trailer fields in between. When such trailers are present, the decoding logic falls into a catch‑all clause that keeps looping without consuming input, causing the worker process to remain pinned for the life of the TCP connection. An attacker or any client that sends properly formatted chunked requests with trailers, even without authentication or special headers, can exhaust the Bandit worker pool and prevent the server from handling further traffic, resulting in a denial‑of‑service.

The vulnerability affects the Bandit HTTP server developed by mtrudel. It is present in versions ranging from 1.6.1 up to, but not including, 1.11.1. Any installations of these versions are susceptible, regardless of the surrounding infrastructure.

With a CVSS score of 8.7, this issue is classified as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploiting the flaw does not require authentication and can be carried out remotely via normal HTTP traffic; proxies such as NGINX and HAProxy that forward trailer-bearing requests may inadvertently expose backends to the attack.