Memory Exhaustion Vulnerability in Elixir Bandit Product by mtrudel

CVE-2026-42788

What is CVE-2026-42788?

An allocation of resources without limits or throttling vulnerability exists in the Elixir Bandit product, where the deserialization process of oversized HTTP/2 frames can lead to memory exhaustion. The issue arises when the frame size check occurs only after requiring the entire frame body in memory, enabling attackers to exploit this flaw by sending oversized frames. By establishing multiple concurrent connections, an unauthorized user can cause the server to exceed its memory capacity, resulting in denial of service and system instability. This vulnerability affects versions 0.3.6 to just below 1.11.0.

References