Denial of Service Vulnerability in mtrudel Bandit Affects Elixir Framework

CVE-2026-39803

What is CVE-2026-39803?

A vulnerability in mtrudel Bandit allows unauthenticated remote attackers to exploit memory exhaustion via specially crafted HTTP/1 chunked requests. Due to a flaw in the read_data function of Elixir's Bandit, the system fails to impose limits on the maximum size of the request body, leading to severe resource depletion. An attacker can send a single request with an arbitrarily large payload, causing the application to exhaust available memory and triggering the operating system's out-of-memory (OOM) killer. This issue affects Bandit versions from 1.4.0 to just before 1.11.1, making it critical for applications using these versions to apply available patches or mitigate potential risks.

References