CVE-2026-116078: HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Q: Which applications are exposed to this issue?

Bandit versions from 0.3.1 before 1.14.1 are affected, but exposure is limited to routes whose Plug reads the request body. This includes routes using Plug.Parsers.

Q: Does exploitation require authentication or a large request body?

No authentication is required. An attacker can send a body as many 1-byte HTTP/2 DATA frames, causing memory overhead per frame; the reported test used 5 MB of data across 100 streams and retained 25 to 40 MiB of stream-process memory.

Q: Why do concurrent HTTP/2 streams make the impact worse?

A connection can interleave frames across up to 500 concurrent streams, allowing multiple stream processes to retain their individual DATA-frame payload lists while each stream consumes data as it arrives. This increases the amount of memory held simultaneously.

Q: What should be done if the application uses affected request-body-reading routes?

Upgrade Bandit to version 1.14.1 or later. The provided information does not describe a configuration-based workaround.

Published Oct 28, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.

doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of readbody/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.

This issue affects bandit: from 0.3.1 before 1.14.1.

Affected Software

1 affected component

hex/bandit>=0.3.1<1.14.1

Event History

Oct 28, 2026

CVE Published

via MITRE·01:26 PM

Data Sourced

via MITRE·01:26 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Bandit versions from 0.3.1 before 1.14.1 are affected, but exposure is limited to routes whose Plug reads the request body. This includes routes using Plug.Parsers.

Does exploitation require authentication or a large request body?

No authentication is required. An attacker can send a body as many 1-byte HTTP/2 DATA frames, causing memory overhead per frame; the reported test used 5 MB of data across 100 streams and retained 25 to 40 MiB of stream-process memory.

Why do concurrent HTTP/2 streams make the impact worse?

A connection can interleave frames across up to 500 concurrent streams, allowing multiple stream processes to retain their individual DATA-frame payload lists while each stream consumes data as it arrives. This increases the amount of memory held simultaneously.

What should be done if the application uses affected request-body-reading routes?

Upgrade Bandit to version 1.14.1 or later. The provided information does not describe a configuration-based workaround.

CVE-2026-116078: HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or a large request body?

Why do concurrent HTTP/2 streams make the impact worse?

What should be done if the application uses affected request-body-reading routes?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

Does exploitation require authentication or a large request body?

Why do concurrent HTTP/2 streams make the impact worse?

What should be done if the application uses affected request-body-reading routes?