CVE-2026-116078: Bandit HTTP/2: Memory exhaustion via request bodies sent as many tiny DATA frames

Summary

Bandit, an HTTP server written in Elixir, does not limit the memory used for HTTP/2 request bodies sent as many 1-byte DATA frames. The byte limit does not count frames, so an unauthenticated remote attacker can make the server hold several times the bytes it sends in memory, spread across up to 500 concurrent streams per connection. This requires HTTP/2 to be enabled and a route whose Plug reads the request body, which includes any route behind Plug.Parsers.

Affected

bandit from 0.3.1 before 1.14.1
Git range c8dc1e9 to 327bb02 (development history)

Fixed in

bandit 1.14.1

Workaround

Disable HTTP/2 with http_2_options: [enabled: false] (available from bandit 0.7.0). This removes HTTP/2 functionality and is a third-party observation, not vendor guidance.

Exploitation

No exploitation in the wild reported.
No public proof of concept found.
EPSS: 0.49 % (percentile 42).
VulDB lists a "0-Day" label with CVSS 5.3, which conflicts with the CNA score of 8.7.

Our recommendation

Upgrade all Hex projects to bandit 1.14.1 and check lock files for versions 1.14.0 or older.
Prioritise internet-facing Bandit servers that use HTTP/2.
Check whether Bandit is used by your applications, for example through Phoenix, and whether HTTP/2 is enabled.
Monitor memory usage and connection counts of affected services.
Verify distribution packages, as their Bandit status is still being evaluated.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CVE record (CNA EEF) cna.erlef.org
OSV record EEF-CVE-2026-116078 osv.dev
GitHub Security Advisory GHSA-pxjf-g536-7r93 github.com
Fix commit 327bb02 github.com
Introducing commit c8dc1e9 github.com
Ubuntu security notice ubuntu.com
VulDB entry 427999 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:46.

Original description (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed