CVE-2026-39806: Pre-Auth RCE in Elixir Bandit via HTTP/1.1 Chunked Decoder Infinite Loop

Vulnerability Summary: EEF-CVE-2026-39806 Vulnerability Overview Vulnerability ID: EEF-CVE-2026-39806 CVSS Score: 9.7 (High) Vulnerability Type: HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit Description: - A "infinite loop" vulnerability exists in , allowing unauthenticated remote denial-of-service (DoS) attacks. - The vulnerability resides in the function in , which only terminates when an empty trailer line (i.e., ) immediately follows the of the final chunk line. - RFC 9112 §7.2 permits zero or more trailer fields. When trailers are present, the computes a negative value, calls which returns after a timeout, and tail-recurses with an unchanged state. - The worker process is pinned for the duration of the TCP connection. - Sending concurrent connection requests containing trailer fields is sufficient to exhaust the Bandit worker pool, preventing the server from responding to subsequent traffic. - No authentication, special headers, or large payloads are required. Proxies such as Nginx and HAProxy that legitimately forward requests with trailer fields can cause the backend servers to be affected, without requiring involvement from a malicious client. - Affected versions: bandit 1.6.1 through 1.11.1. Scope Affected Package: Source: GitHub - github.com/mtrudel/bandit Affected Versions: - Introduced Version: 1.6.1 - Patched Version: 1.11.1 - Affected Version Range: Remediation Patch Version: Upgrade to or later. Patch Commit: GitHub Commit Package Repository: Hex.pm Packages References GitHub Advisory CNA Entry GitHub Commit Hex Packages Credits Peter Ullrich - FINDER Mat Trudel - REMEDIATION_DEVELOPER Jonathan Männchen - ANALYST Database Specific

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-39806: Pre-Auth RCE in Elixir Bandit via HTTP/1.1 Chunked Decoder Infinite Loop