CVE-2026-111101 (GCVE-0-2026-111101)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:31 – Updated: 2026-10-26 15:35
VLAI
EPSS
VEX
Title
HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
Summary
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.
The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.
This issue affects bandit: from 0.1.0 before 1.14.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:10 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mtrudel/bandit/security/adviso… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-111101.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-111101 | related |
| https://github.com/mtrudel/bandit/commit/7201270c… | related |
| https://github.com/mtrudel/bandit/commit/220b9dfd… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:10:33.224480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:35:51.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.14.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
"status": "affected",
"version": "7201270c34b90f6c9e15c0386c2bb802c0c72ab4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mat Trudel"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-23T12:35:54.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\u003c/p\u003e\n\u003cp\u003eThe chunked reader in \u003ccode\u003elib/bandit/http1/socket.ex\u003c/code\u003e keeps every chunk as its own list cell and binary term until \u003ccode\u003eIO.iodata_to_binary/1\u003c/code\u003e joins them, and nothing limits the number of chunks. The \u003ccode\u003e:length\u003c/code\u003e option of \u003ccode\u003eread_body/2\u003c/code\u003e counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections \u003ccode\u003eensure_completed/1\u003c/code\u003e drains unread bodies through the same reader.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.1.0 before 1.14.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in `lib/bandit/http1/socket.ex` keeps every chunk as its own list cell and binary term until `IO.iodata_to_binary/1` joins them, and nothing limits the number of chunks. The `:length` option of `read_body/2` counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections `ensure_completed/1` drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body."
}
],
"value": "An unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:31:48.184Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw"
},
{
"name": "EEF CNA record for CVE-2026-111101",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-111101.html"
},
{
"name": "OSV record EEF-CVE-2026-111101",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-111101"
},
{
"name": "Introducing commit 7201270 in mtrudel/bandit",
"tags": [
"related"
],
"url": "https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4"
},
{
"name": "Fix commit 220b9df in mtrudel/bandit",
"tags": [
"patch"
],
"url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFrom 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with \u003ccode\u003ehttp_1_options: [enabled: false]\u003c/code\u003e, so that the vulnerable chunked body reader never runs.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "From 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with `http_1_options: [enabled: false]`, so that the vulnerable chunked body reader never runs."
}
],
"value": "From 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with http_1_options: [enabled: false], so that the vulnerable chunked body reader never runs."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eRun Bandit with a Plug that calls \u003ccode\u003ePlug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003ePOST /\u003c/code\u003e with \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e and a body of 1,000,000 chunks of \u003ccode\u003e1\\r\\nA\\r\\n\u003c/code\u003e, followed by \u003ccode\u003e0\\r\\n\\r\\n\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWhen \u003ccode\u003eread_body\u003c/code\u003e returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Run Bandit with a Plug that calls `Plug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000)`.\n2. Send `POST /` with `Transfer-Encoding: chunked` and a body of 1,000,000 chunks of `1\\r\\nA\\r\\n`, followed by `0\\r\\n\\r\\n`.\n3. When `read_body` returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent."
}
],
"value": "* Run Bandit with a Plug that calls Plug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000).\n* Send POST / with Transfer-Encoding: chunked and a body of 1,000,000 chunks of 1\\r\\nA\\r\\n, followed by 0\\r\\n\\r\\n.\n* When read_body returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Per-chunk accumulation.\u003c/strong\u003e \u003ccode\u003edo_read_chunked_data!\u003c/code\u003e in \u003ccode\u003elib/bandit/http1/socket.ex\u003c/code\u003e collects chunks as \u003ccode\u003e[body | chunk]\u003c/code\u003e, adding a cons cell and a binary term for every chunk.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Byte-only limit.\u003c/strong\u003e \u003ccode\u003e:length\u003c/code\u003e limits data bytes, not the number of chunks, so a body of \u003ccode\u003e1\\r\\nx\\r\\n\u003c/code\u003e chunks becomes an 8-million-element improper list before \u003ccode\u003eIO.iodata_to_binary\u003c/code\u003e runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. No body read needed.\u003c/strong\u003e On keep-alive connections, \u003ccode\u003eensure_completed/1\u003c/code\u003e drains unread bodies through the same path. Against a Plug that never calls \u003ccode\u003eread_body\u003c/code\u003e, the attack used about 417 MB.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Per-chunk accumulation.** `do_read_chunked_data!` in `lib/bandit/http1/socket.ex` collects chunks as `[body | chunk]`, adding a cons cell and a binary term for every chunk.\n\n**2. Byte-only limit.** `:length` limits data bytes, not the number of chunks, so a body of `1\\r\\nx\\r\\n` chunks becomes an 8-million-element improper list before `IO.iodata_to_binary` runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\n\n**3. No body read needed.** On keep-alive connections, `ensure_completed/1` drains unread bodies through the same path. Against a Plug that never calls `read_body`, the attack used about 417 MB."
}
],
"value": "1. Per-chunk accumulation. do_read_chunked_data! in lib/bandit/http1/socket.ex collects chunks as [body | chunk], adding a cons cell and a binary term for every chunk.\n\n2. Byte-only limit. :length limits data bytes, not the number of chunks, so a body of 1\\r\\nx\\r\\n chunks becomes an 8-million-element improper list before IO.iodata_to_binary runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\n\n3. No body read needed. On keep-alive connections, ensure_completed/1 drains unread bodies through the same path. Against a Plug that never calls read_body, the attack used about 417 MB."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-111101",
"datePublished": "2026-10-26T13:31:48.184Z",
"dateReserved": "2026-10-23T12:30:01.834Z",
"dateUpdated": "2026-10-26T15:35:51.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-111101",
"date": "2026-10-27",
"epss": "0.00602",
"percentile": "0.48612"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.14.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
"status": "affected",
"version": "7201270c34b90f6c9e15c0386c2bb802c0c72ab4",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0."
}
],
"id": "CVE-2026-111101",
"lastModified": "2026-10-26T16:59:16.113",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-111101",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:10:33.224480Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-26T14:16:27.227",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-111101.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-111101"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T15:10:33.224480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:32:46.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.14.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
"status": "affected",
"version": "7201270c34b90f6c9e15c0386c2bb802c0c72ab4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mat Trudel"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-23T12:35:54.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\u003c/p\u003e\n\u003cp\u003eThe chunked reader in \u003ccode\u003elib/bandit/http1/socket.ex\u003c/code\u003e keeps every chunk as its own list cell and binary term until \u003ccode\u003eIO.iodata_to_binary/1\u003c/code\u003e joins them, and nothing limits the number of chunks. The \u003ccode\u003e:length\u003c/code\u003e option of \u003ccode\u003eread_body/2\u003c/code\u003e counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections \u003ccode\u003eensure_completed/1\u003c/code\u003e drains unread bodies through the same reader.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.1.0 before 1.14.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in `lib/bandit/http1/socket.ex` keeps every chunk as its own list cell and binary term until `IO.iodata_to_binary/1` joins them, and nothing limits the number of chunks. The `:length` option of `read_body/2` counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections `ensure_completed/1` drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks.\n\nThe chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader.\n\nThis issue affects bandit: from 0.1.0 before 1.14.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body."
}
],
"value": "An unauthenticated client can make a single HTTP/1.1 request hold many times its body size in server memory (about 48 MB for a 1 MB body in the reporter\u0027s test), and keep CPU busy while the chunks are joined. This affects any Bandit server that accepts HTTP/1.1 requests, whether or not its routes read the body."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:31:48.184Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw"
},
{
"name": "EEF CNA record for CVE-2026-111101",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-111101.html"
},
{
"name": "OSV record EEF-CVE-2026-111101",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-111101"
},
{
"name": "Introducing commit 7201270 in mtrudel/bandit",
"tags": [
"related"
],
"url": "https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4"
},
{
"name": "Fix commit 220b9df in mtrudel/bandit",
"tags": [
"patch"
],
"url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFrom 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with \u003ccode\u003ehttp_1_options: [enabled: false]\u003c/code\u003e, so that the vulnerable chunked body reader never runs.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "From 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with `http_1_options: [enabled: false]`, so that the vulnerable chunked body reader never runs."
}
],
"value": "From 0.7.0, a server whose clients and proxies all speak HTTP/2 can disable HTTP/1 with http_1_options: [enabled: false], so that the vulnerable chunked body reader never runs."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eRun Bandit with a Plug that calls \u003ccode\u003ePlug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend \u003ccode\u003ePOST /\u003c/code\u003e with \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e and a body of 1,000,000 chunks of \u003ccode\u003e1\\r\\nA\\r\\n\u003c/code\u003e, followed by \u003ccode\u003e0\\r\\n\\r\\n\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWhen \u003ccode\u003eread_body\u003c/code\u003e returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Run Bandit with a Plug that calls `Plug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000)`.\n2. Send `POST /` with `Transfer-Encoding: chunked` and a body of 1,000,000 chunks of `1\\r\\nA\\r\\n`, followed by `0\\r\\n\\r\\n`.\n3. When `read_body` returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent."
}
],
"value": "* Run Bandit with a Plug that calls Plug.Conn.read_body(conn, length: 1_000_000, read_length: 1_000_000).\n* Send POST / with Transfer-Encoding: chunked and a body of 1,000,000 chunks of 1\\r\\nA\\r\\n, followed by 0\\r\\n\\r\\n.\n* When read_body returns the 1,000,000 body bytes, the handler process holds about 48 MB and BEAM memory has grown by about 55 MB, for 6 MB sent."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Per-chunk accumulation.\u003c/strong\u003e \u003ccode\u003edo_read_chunked_data!\u003c/code\u003e in \u003ccode\u003elib/bandit/http1/socket.ex\u003c/code\u003e collects chunks as \u003ccode\u003e[body | chunk]\u003c/code\u003e, adding a cons cell and a binary term for every chunk.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Byte-only limit.\u003c/strong\u003e \u003ccode\u003e:length\u003c/code\u003e limits data bytes, not the number of chunks, so a body of \u003ccode\u003e1\\r\\nx\\r\\n\u003c/code\u003e chunks becomes an 8-million-element improper list before \u003ccode\u003eIO.iodata_to_binary\u003c/code\u003e runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. No body read needed.\u003c/strong\u003e On keep-alive connections, \u003ccode\u003eensure_completed/1\u003c/code\u003e drains unread bodies through the same path. Against a Plug that never calls \u003ccode\u003eread_body\u003c/code\u003e, the attack used about 417 MB.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Per-chunk accumulation.** `do_read_chunked_data!` in `lib/bandit/http1/socket.ex` collects chunks as `[body | chunk]`, adding a cons cell and a binary term for every chunk.\n\n**2. Byte-only limit.** `:length` limits data bytes, not the number of chunks, so a body of `1\\r\\nx\\r\\n` chunks becomes an 8-million-element improper list before `IO.iodata_to_binary` runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\n\n**3. No body read needed.** On keep-alive connections, `ensure_completed/1` drains unread bodies through the same path. Against a Plug that never calls `read_body`, the attack used about 417 MB."
}
],
"value": "1. Per-chunk accumulation. do_read_chunked_data! in lib/bandit/http1/socket.ex collects chunks as [body | chunk], adding a cons cell and a binary term for every chunk.\n\n2. Byte-only limit. :length limits data bytes, not the number of chunks, so a body of 1\\r\\nx\\r\\n chunks becomes an 8-million-element improper list before IO.iodata_to_binary runs. Sending 48 MB of 1-byte chunks grew the handler heap to about 500 MB and used about 6 s of CPU. The same body as one 8 MB chunk peaked at about 16 MB and took 5 ms.\n\n3. No body read needed. On keep-alive connections, ensure_completed/1 drains unread bodies through the same path. Against a Plug that never calls read_body, the attack used about 417 MB."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-111101",
"datePublished": "2026-10-26T13:31:48.184Z",
"dateReserved": "2026-10-23T12:30:01.834Z",
"dateUpdated": "2026-10-26T15:35:51.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.