CVE-2026-116078— HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mtrudel bandit 库的 HTTP/2 请求体读取器中存在“无限制或无节流机制的资源分配”漏洞。该漏洞允许未认证的远程攻击者通过发送大量 1 字节 DATA 帧形式的请求体，耗尽服务器内存。在模块的函数中，每个 DATA 帧的有效载荷在读取完成前都被单独保存为一个列表元素。而函数的选项仅统计请求体的字节数，并未对帧数量进行限制。因此，若请求体由 1 字节的帧组成，则每字节都会额外消耗一个列表单元格和一个二进制项（binary term）。此外，攻击者可在单个连接上并行使用最多 500 个流，交错

CVSS 8.7 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	0.3.1 ~ 1.14.1	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f ~ 327bb02ff84171237e1aeff787930debd16155ee	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-116078

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116078

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116078 (1)

🔗 Implement request body reads (DATA frame reads) · mtrudel/bandit@c8dc1e9 · GitHub Read full article related

Other References for CVE-2026-116078 (4)

https://osv.dev/vulnerability/EEF-CVE-2026-116078 related
https://cna.erlef.org/cves/CVE-2026-116078.html related
https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee patch
https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93 vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-116078

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-770