Resource Exhaustion Vulnerability in mtrudel Bandit HTTP/2 Reader

CVE-2026-116078

What is CVE-2026-116078?

A resource exhaustion vulnerability exists in the HTTP/2 request body reader of mtrudel Bandit. An unauthenticated remote attacker can exploit this flaw by sending many 1-byte DATA frames, which causes excessive memory use on the server. The handling of DATA frames by the read_body function results in significant memory overhead, particularly in scenarios with numerous concurrent streams. This issue primarily affects routes that handle request bodies through Plug, potentially allowing attackers to exhaust server resources and impact service availability.

References