CVE-2026-116078 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.
A resource exhaustion vulnerability has been identified in the Bandit web server framework, specifically in versions 0.3.1 prior to 1.14.1. This vulnerability allows an unauthenticated remote attacker to deplete server memory by sending HTTP/2 request bodies composed of numerous 1-byte DATA frames. The issue arises because the request body reader accumulates each DATA frame payload as a separate list element, leading to significant memory overhead. Interleaving these frames across multiple concurrent streams further exacerbates the problem, causing each stream to consume excessive memory for the duration of the body read.
Users can upgrade to Bandit version 1.14.1 or later, or disable HTTP/2 in versions 0.7.0 and later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-116078.html | EEF | AdvisoryTechnical Description |
| https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee | EEF | Source CodeVendor |
| https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f | EEF | Source CodeVendor |
| https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-116078 | EEF | AdvisoryTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| mtrudel bandit | >= 0.3.1, < 1.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | EEF |