EUVD-2026-29950
GHSA-9q9q-324x-93r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen TCP connection to Bandit HTTP port
-
DeliverySend POST any path, Transfer-Encoding: chunked
-
ExploitStream oversized chunked body past 8 MB cap
-
ExecutionBandit buffers full body in memory
-
PersistBEAM exhausts RAM, OOM-killed
-
ImpactService denial for all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target run Bandit 1.4.0-1.11.0 as its HTTP/1 server AND that the request use Transfer-Encoding: chunked (the Content-Length path is not vulnerable). In the standard Phoenix/Plug endpoint a Plug.Parsers plug (json, urlencoded, or multipart with pass matching the request Content-Type) must be reachable, which is the default configuration - Plug.Parsers executes before routing and auth, so no valid route, session, or credentials are required and any path works. Limiting factors: the attack only affects HTTP/1 chunked bodies, so a fronting proxy that terminates chunked encoding or enforces its own body-size cap before Bandit neutralizes it; deployments serving only over HTTP/2, or that stream request bodies without Plug.Parsers, are less exposed. Impact is confined to availability (process/node crash), with no data disclosure or code execution. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: network-reachable, low-complexity, unauthenticated, availability-only impact - a clean single-request DoS with no confidentiality or integrity effect, scoring 8.7. SSVC reinforces prioritization: Exploitation=poc (matching the published PoC), Automatable=yes (trivially scriptable and repeatable), Technical Impact=partial (service crash, not full system compromise). The tension in the signals is EPSS: 0.31% (54th percentile) is low, which is typical for DoS bugs that are noisy and not attacker-monetizable rather than an indicator of low exploitability - the bug is genuinely easy to trigger. This is a real availability priority for any internet-facing Bandit deployment because it requires no auth and no valid route, but it is not a remote-code-execution or data-breach event. Absent KEV listing, treat it as high-value-to-patch but not emergency-out-of-band unless the service is exposed and availability-critical. |
| Exploit ScenarioDerived | An attacker points a short script at any URL of an internet-facing Phoenix/Plug app served by vulnerable Bandit and opens a single POST with Transfer-Encoding: chunked and a Content-Type matching a configured parser, streaming multi-megabyte chunks indefinitely. Because Plug.Parsers runs before routing and authentication, no credentials or valid route are needed; the server buffers the entire body until beam.smp RSS exceeds available memory and the OS OOM killer terminates the node. A working PoC (chunked_oom.exs) is published in the GHSA advisory, making this trivially reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Unauthenticated remote denial of service in Bandit (the Elixir HTTP/1 web server for Phoenix/Plug applications) versions 1.4.0 through 1.11.0 allows an attacker to crash the entire BEAM VM by sending a single Transfer-Encoding: chunked POST with an oversized body. The chunked-body reader ignores the application's configured :length cap (e.g. Plug.Parsers' default 8 MB), buffering the whole body in memory until the OS OOM killer terminates the process. Publicly available exploit code exists (a self-contained PoC ships in the GHSA advisory), though EPSS remains low at 0.31% and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: 1.11.1 - upgrade the bandit dependency to 1.11.1 or later (mix deps.update bandit / pin {:bandit, "~> 1.11.1"} in mix.exs), which changes do_read_chunked_data! to track accumulated bytes against the :length option and return {:more, ...} or raise a request_error! once the cap is exceeded (fix commit ae3520dfdbfab115c638f8c7f6f6b805db34e1ab). If you cannot upgrade immediately, place a reverse proxy or load balancer in front of Bandit and enforce a hard request-body size limit there (for example nginx client_max_body_size or an equivalent cap on chunked/streamed bodies) so oversized bodies are rejected before reaching the BEAM - the trade-off is that legitimate large uploads will also be capped and you must ensure the proxy limit is applied to chunked transfers, not just Content-Length requests. As an operational backstop, constrain the BEAM process memory (cgroup/systemd MemoryMax) so an OOM affects only that container rather than the host, accepting that the service still crashes on attack. Advisories: https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2 and https://cna.erlef.org/cves/CVE-2026-39803.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bandit is a pure-Elixir HTTP server built on Thousand Island that serves as the Plug/Phoenix web adapter, increasingly the default in modern Phoenix stacks. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): in lib/bandit/http1/socket.ex, the chunked clause of read_data/2 forwards only :read_length and :read_timeout to do_read_chunked_data!/5 and drops the caller-supplied :length option. It accumulates every chunk into an iolist and calls IO.iodata_to_binary/1 to materialize the full body, always returning {:ok, body, ...} and never {:more, ...}, so upstream callers (Plug.Parsers) get no chance to emit a 413. By contrast, the Content-Length path correctly bounds reads with min(unread_content_length, Keyword.get(opts, :length, 8_000_000)) and is unaffected. The CPE cpe:2.3:a:mtrudel:bandit identifies the affected package.
Know when Bandit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, single-request trigger with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N) with no scope change.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.
The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.
Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.
The content-length path in the same function correctly enforces the limit and is not affected.
This issue affects bandit: from 1.4.0 before 1.11.1.
Executive ViewAI
Bandit HTTP server versions 1.4.0-1.11.0, commonly used in Elixir/Phoenix applications, contains an unauthenticated denial-of-service vulnerability; publicly available exploit code exists. Organizations running affected versions face immediate risk of complete application server outages triggered by a single malformed request from any internet-connected attacker. Immediate patching to Bandit 1.12.0 or later is required to maintain application availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Memory exhaustion in Bandit WebSocket server (versions 0.5.0 through 1.10.x) allows unauthenticated remote attackers to
Memory exhaustion in Bandit WebSocket server (versions 0.5.9 through 1.10.x) allows unauthenticated remote attackers to
Denial of service in mtrudel bandit via HTTP/2 frame deserialization allows unauthenticated remote attackers to exhaust
Transport-state spoofing in Bandit 1.0.0 through 1.10.x allows unauthenticated remote attackers to forge HTTPS connectio
HTTP request smuggling in mtrudel bandit before version 1.11.0 allows unauthenticated attackers to bypass edge security
Uncontrolled HTTP/2 flow-control resource consumption in mtrudel/bandit 1.4.0 and later lets an unauthenticated remote p
Unauthenticated remote denial of service in mtrudel Bandit (Elixir HTTP server) versions 1.6.1 through 1.11.0 lets any c
CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassem
Bandit's HTTP/2 request body reader amplifies memory use, letting an unauthenticated remote client make a server hold ro
Unauthenticated remote CPU exhaustion in mtrudel Bandit's HTTP/2 server (versions before 1.14.0) is achievable by holdin
Unbounded per-connection memory and CPU growth in the Elixir Bandit HTTP/2 server (0.3.6 up to 1.14.0) lets an unauthent
Unauthenticated remote attackers can exhaust BEAM node memory on default-configured mtrudel Bandit HTTP/2 servers (0.3.3
Exploit-DB