{"id":"CVE-2026-116078","revision":"3c8cde9c56ab413cb99bff0a079a2dce","records":[{"revision":"3c8cde9c56ab413cb99bff0a079a2dce","observedAt":"2026-10-28T14:46:48.769+00:00","statement":{"source":"cve-program","id":"CVE-2026-116078","aliases":[],"title":"HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit","description":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.\n\ndo_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.\n\nThis issue affects bandit: from 0.3.1 before 1.14.1.","state":0,"publishedAt":"2026-10-28T13:26:25.372+00:00","modifiedAt":"2026-10-28T13:26:25.372+00:00","affected":[{"ecosystem":"https://repo.hex.pm","name":"bandit","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.hex.pm\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"bandit\",\n                    \"packageURL\": \"pkg:hex/bandit\",\n                    \"product\": \"bandit\",\n                    \"repo\": \"https://github.com/mtrudel/bandit\",\n                    \"vendor\": \"mtrudel\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.14.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.3.1\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"mtrudel/bandit","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"mtrudel/bandit\",\n                    \"packageURL\": \"pkg:github/mtrudel/bandit\",\n                    \"product\": \"bandit\",\n                    \"repo\": \"https://github.com/mtrudel/bandit\",\n                    \"vendor\": \"mtrudel\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"327bb02ff84171237e1aeff787930debd16155ee\",\n                            \"status\": \"affected\",\n                            \"version\": \"c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93","https://cna.erlef.org/cves/CVE-2026-116078.html","https://osv.dev/vulnerability/EEF-CVE-2026-116078","https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f","https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116078","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-116078","identifiers":["CVE-2026-116078"]},"retained":false,"historicalAffected":[]}],"coverage":[]}