CVE-2026-116078

CVE-2026-116078 · HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published

2026-10-28T13:26:25.372Z

Updated

2026-10-28T13:26:25.372Z

Stack: system

Check your server →