Bandit EUVD-2026-109820

Exploitation requires Bandit versions 1.12.4 up to (but not including) 1.14.0 with HTTP/1.1 enabled (the default), AND - critically - a front-end proxy deployed ahead of Bandit that treats a bare LF as a line terminator inside the chunk-size line and forwards chunked request bodies unchanged. This proxy behavior is the AT:P attack requirement and is outside the attacker's control; the advisory states deployments without such a proxy are not affected. No authentication is required (PR:N) and no user interaction is needed. The vendor workaround, where the proxy can reach Bandit over HTTP/2, is to disable HTTP/1 with http_1_options: [enabled: false] so the chunked body reader never runs; otherwise upgrading to 1.14.0 is the fix.

This is a medium-severity request-smuggling flaw (CWE-444) with a CVSS 4.0 base score of 6.3. The signals are internally consistent and point to a real but conditional risk rather than a blanket emergency. The vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated attack, but the AT:P 'attack requirement' is the decisive qualifier: exploitation only works when Bandit sits behind a specific kind of front-end proxy that treats a bare LF as a line terminator and forwards chunked bodies unchanged - the advisory explicitly states deployments without such a proxy are not affected. No EPSS score and no CISA KEV entry were provided, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now or emergency), matching a patch-promptly-but-not-drop-everything posture. A detailed proof-of-concept walkthrough is published in the GHSA advisory, and the introducing/fix commits are public, so the mechanism is fully disclosed. Net: a genuine patch-this-month item for Elixir/Erlang shops running Bandit behind a non-conforming proxy, not a high-CVSS-but-illusory issue, but also not a default-configuration internet-wide threat because of the proxy dependency.

An unauthenticated remote attacker sends a single POST with Transfer-Encoding: chunked whose chunk-size line carries a chunk extension containing a bare LF (e.g. 2;\nxx\r\n40\r\n0\r\n\r\n followed by a smuggled GET /admin). A front-end proxy that ends the size line at the bare LF sees one benign POST, while Bandit ends the body early and dispatches the embedded GET /admin as a separate pipelined request, slipping past the proxy's access controls. A step-by-step public PoC is described in the GHSA advisory, though it is not packaged as a standalone weaponized exploit tool.