CVE-2026-114216— Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mtrudel bandit 的 HTTP/1.1 分块（chunked）主体读取器中存在“HTTP 请求/响应不一致解析”（即 HTTP 请求/响应走私，HTTP Request/Response Smuggling）漏洞。该漏洞允许未认证的远程攻击者利用包含单个换行符（LF）的分块扩展（chunk extension），将第二个请求通过前端代理进行走私。具体而言，位于的分块读取器将分块大小行（chunk-size line）视为从行首到第一个 CRLF 之间的所有内容，并直接丢弃分号（）之后的所有数据，而

CVSS 6.3 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected. This issue affects bandit: from 1.12.4 before 1.14.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

HTTP请求的解释不一致性(HTTP请求私运)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	1.12.4 ~ 1.14.0	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	c31e9e3c76dcbfc239a96eabed5341ced7885ae5 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-114216

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114216

请登录查看更多情报信息。

Other References for CVE-2026-114216 (5)

https://osv.dev/vulnerability/EEF-CVE-2026-114216 related
https://cna.erlef.org/cves/CVE-2026-114216.html related
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a patch
https://github.com/mtrudel/bandit/commit/c31e9e3c76dcbfc239a96eabed5341ced7885ae5 related
https://github.com/mtrudel/bandit/security/advisories/GHSA-w5wc-g2hc-g7m2 vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-114216

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213	8.7 HIGH	WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584	8.7 HIGH	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101	8.7 HIGH	HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436	8.7 HIGH	Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529	8.7 HIGH	SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-108525	8.7 HIGH	HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269	8.7 HIGH	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499	8.7 HIGH	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103	8.2 HIGH	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-110314	6.3 MEDIUM	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-444