Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-114213— WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mtrudel 开发的 Bandit 库在 WebSocket 分片重组过程中存在“无限制或无流控的资源分配”漏洞。该漏洞允许未经身份验证的远程攻击者通过发送由大量 1 字节延续帧（continuation frames）组成的分片消息，耗尽服务器内存。 Bandit.WebSocket.Connection 会将接收到的有效载荷字节数与进行比较，但会将每个非最终的延续帧作为独立列表单元（list cell）进行存储，且未对分片数量设置任何上限。一个 1 字节的分片在传输中仅占用 7 字节，但在服务器端却需消耗约

CVSS 8.7 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout. This issue affects bandit: from 1.11.0 before 1.14.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	1.11.0 ~ 1.14.0	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	21612c7c7b1ce43eccd36d3af3a2299d23513667 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-114213

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114213

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114213 (1)

🔗 Merge commit from fork · mtrudel/bandit@21612c7 · GitHub Read full article related

Other References for CVE-2026-114213 (4)

https://osv.dev/vulnerability/EEF-CVE-2026-114213 related
https://cna.erlef.org/cves/CVE-2026-114213.html related
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a patch
https://github.com/mtrudel/bandit/security/advisories/GHSA-cpx7-qf6w-jc63 vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-114213

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-109584	8.7 HIGH	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101	8.7 HIGH	HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436	8.7 HIGH	Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529	8.7 HIGH	SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-108525	8.7 HIGH	HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269	8.7 HIGH	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499	8.7 HIGH	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103	8.2 HIGH	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-114216	6.3 MEDIUM	Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314	6.3 MEDIUM	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-770