CVEsmtrudelCVE-2026-116078Published Oct 28, 13:26 · Updated Oct 28, 13:26 UTC
8.7
HighCVSS 4.0 · from EEF
CVE-2026-116078

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

bandit · Allocation without limits · CWE-770
Affectedbandit, mtrudel/bandit
FixUpdate to 1.14.1, 327bb02ff84171237e1aeff787930debd16155ee or newer
PublishedOct 28, 13:26 · EEF
ScoredOct 28 · 8.7 · EEF
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.

Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

From EEF

Affected and fixed versions

ProductAffectedFixed inbandit0.3.1 – before 1.14.11.14.1mtrudel/banditc8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f – before 327bb02ff84171237e1aeff787930debd16155ee327bb02ff84171237e1aeff787930debd16155ee

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit · github.comvendor advisoryrelatedEEF CNA record for CVE-2026-116078 · cna.erlef.orgrelatedOSV record EEF-CVE-2026-116078 · osv.devrelatedIntroducing commit c8dc1e9 in mtrudel/bandit · github.comrelatedFix commit 327bb02 in mtrudel/bandit · github.compatch

Other CVEs in bandit

All 23 →
8.7SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit · CVE-2026-108529Oct 268.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit · CVE-2026-110499Oct 268.7HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit · CVE-2026-109584Oct 26