CVEsmtrudelCVE-2026-111101Published Oct 26, 13:31 · Updated Oct 26, 15:35 UTC
8.7
HighCVSS 4.0 · from EEF
CVE-2026-111101

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

bandit · Allocation without limits · CWE-770
Affectedbandit, mtrudel/bandit
FixUpdate to 1.14.0, 220b9dfd27f9a21305be2afc75cbe585ddc24e7a or newer
PublishedOct 26, 13:31 · EEF
ScoredOct 26 · 8.7 · EEF
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC

What we know

No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.

Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader. This issue affects bandit: from 0.1.0 before 1.14.0.

From EEF

Affected and fixed versions

ProductAffectedFixed inbandit0.1.0 – before 1.14.01.14.0mtrudel/bandit7201270c34b90f6c9e15c0386c2bb802c0c72ab4 – before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a220b9dfd27f9a21305be2afc75cbe585ddc24e7a

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit · github.comvendor advisoryrelatedEEF CNA record for CVE-2026-111101 · cna.erlef.orgrelatedOSV record EEF-CVE-2026-111101 · osv.devrelatedIntroducing commit 7201270 in mtrudel/bandit · github.comrelatedFix commit 220b9df in mtrudel/bandit · github.compatch

Other CVEs in bandit

All 23 →
8.7HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit · CVE-2026-116078Oct 288.7SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit · CVE-2026-108529Oct 268.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit · CVE-2026-110499Oct 26