CVE-2026-116078

CVE-2026-116078 · HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

CVSS 8.7 · Hoch · EPSS 0,5% · Korrektur verfügbar

Veröffentlicht

2026-10-28T13:26:25.372Z

Aktualisiert

2026-10-28T13:26:25.372Z

Technologie-Stack: system

Prüfen Sie Ihren Server →