CVE-2026-111101— HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 mtrudel bandit 库的 HTTP/1.1 分块（chunked）主体读取器中存在“未限制或未进行流量控制的资源分配”漏洞。该漏洞允许未经身份验证的远程攻击者通过构造包含大量 1 字节分块的请求主体，耗尽服务器的内存和 CPU 资源。位于中的分块读取器会将每个分块作为独立的列表单元（list cell）和二进制项（binary term）保留，直到调用将其合并为止，且没有任何机制限制分块数量。函数的选项仅统计数据字节数，因此极小的分块所消耗的内存远大于其实际负载：48 MB 的 1 字节分块

CVSS 8.7 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader. This issue affects bandit: from 0.1.0 before 1.14.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	0.1.0 ~ 1.14.0	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	7201270c34b90f6c9e15c0386c2bb802c0c72ab4 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-111101

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111101

请登录查看更多情报信息。

Other References for CVE-2026-111101 (5)

https://osv.dev/vulnerability/EEF-CVE-2026-111101 related
https://cna.erlef.org/cves/CVE-2026-111101.html related
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a patch
https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4 related
https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-111101

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213	8.7 HIGH	WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584	8.7 HIGH	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-113436	8.7 HIGH	Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529	8.7 HIGH	SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-108525	8.7 HIGH	HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269	8.7 HIGH	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499	8.7 HIGH	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103	8.2 HIGH	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-114216	6.3 MEDIUM	Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314	6.3 MEDIUM	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-770