Bandit CVE-2026-116078

Two concrete preconditions must both hold: (1) HTTP/2 must be enabled on the Bandit listener (it is enabled by default; the documented workaround from 0.7.0 is http_2_options: [enabled: false]), and (2) the target route's Plug must actually read the request body - which any route behind Plug.Parsers does for POST, PUT, and PATCH. No authentication is required (CVSS PR:N) and no user interaction (UI:N). Limiting factors that reduce realistic impact: the attack only bites routes that read bodies, the memory overhead is an amplification ratio (~5-8x bytes sent) held only for the duration of each open read rather than an unbounded or permanent allocation, and it is bounded per connection by the 500-concurrent-stream cap, so sustained denial of service requires many concurrent streams and connections held open against the read_timeout deadline. The complete fix is upgrading to bandit 1.14.1; disabling HTTP/2 is the only stated workaround and removes HTTP/2 functionality.

This is a genuine but bounded availability risk, best read as 'patch this_week' rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and is internally consistent with the description: an unauthenticated remote attacker over the network can trigger the flaw with low complexity and no user interaction, and the only impact metric set is VA:H (availability high), with VC:N/VI:N - no confidentiality or integrity loss, which matches a CWE-770 memory-exhaustion denial of service. No EPSS score, no CISA KEV listing, and no 'POC confirmed' flag are present in the input, so there is no signal of active exploitation; however, the GHSA advisory itself contains a detailed step-by-step reproduction, so a public PoC reference exists even though it is not verified as packaged working exploit code. The vuln.today Decision label is 'this_week,' consistent with a high-severity, network-reachable, unauthenticated DoS against which a patch already exists. The main factors moderating real-world urgency are deployment preconditions (HTTP/2 must be enabled and the route must read the request body) and the fact that the amplification is a ~5-8x memory multiplier bounded by the read deadline and the 500-streams-per-connection limit, i.e. resource pressure rather than a single-request crash. Missing data to note explicitly: EPSS is absent, so widespread-vs-targeted exploitation likelihood cannot be quantified; KEV is not listed; and no third party has independently confirmed exploitation.

An unauthenticated attacker opens an HTTP/2 (h2c or TLS) connection to a Bandit server and sends POST requests on up to 100-500 concurrent streams, each carrying its request body as thousands of interleaved 1-byte DATA frames without END_STREAM. Because Bandit accumulates each frame as its own list cell plus heap binary and bounds reads only by byte count, the server holds roughly 5-8x the bytes sent in stream-process memory for the life of each open body read; repeating this across many connections drives the BEAM toward memory exhaustion. The GHSA advisory publishes a concrete reproduction (100 streams × 5,000 frames held 25-40 MiB for ~5 MB sent), so a public PoC reference exists, though it is not verified as a packaged working exploit.