# CVE-2026-116078: mtrudel bandit resource exhaustion in HTTP/2 request body reader

Source: https://junglewise.ai/threats/cve-2026-116078-allocation-of-resources-without-limits-or-throttling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116078 · Severity: info · Published 2026-10-28

Bandit is an HTTP server library for Elixir that processes web requests. A flaw in its HTTP/2 implementation allows an attacker to crash the server by sending many small request body chunks, causing the server to consume excessive memory and become unavailable. Only applications that read the request body are affected.

Technologies: [Mtrudel Bandit](https://junglewise.ai/threats/technologies/mtrudel-bandit). Vendors: [Mtrudel](https://junglewise.ai/threats/vendors/mtrudel).

## Quick answers

**Is CVE-2026-116078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116078 being exploited in the wild.

**How severe is CVE-2026-116078?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Mtrudel Bandit 0.3.1 to before 1.14.1.

**Is there a fix for CVE-2026-116078?** Yes: fixed in 1.14.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116078 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116078?** Check whether you run Mtrudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.14.1

## Technical details

The vulnerability is an unbounded resource allocation in the do_read_data/5 function in lib/bandit/http2/stream.ex. Each HTTP/2 DATA frame payload is stored as a separate list element; an attacker can send one-byte frames across up to 500 concurrent streams to accumulate large amounts of stream process memory without hitting the read_body/2 length limit. No authentication is required; only network access to the server is needed.

## Affected products

- mtrudel bandit 0.3.1 to before 1.14.1

## Timeline

- 2026-10-28: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [mtrudel bandit HTTP/2 stream resource exhaustion](https://junglewise.ai/threats/cve-2026-115269-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit WebSocket denial of service via fragmented messages](https://junglewise.ai/threats/cve-2026-114213-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit inefficient algorithmic complexity in header parser](https://junglewise.ai/threats/cve-2026-113436-inefficient-algorithmic-complexity-vulnerability-in-the-header)
- [mtrudel bandit HTTP/2 handler resource limit bypass](https://junglewise.ai/threats/cve-2026-111103-improper-cleanup-on-thrown-exception-vulnerability-in-the-http-2)
- [mtrudel bandit HTTP/1.1 chunked body denial of service](https://junglewise.ai/threats/cve-2026-111101-allocation-of-resources-without-limits-or-throttling)