Executive brief
Bandit, a high-performance HTTP server for Elixir, contains a flaw in how it handles certain types of web requests. An unauthenticated attacker can send a specially crafted request that forces the server to consume all available system memory. This results in a complete crash of the application, causing a denial of service for all users. Because this occurs before the application checks user credentials, any publicly accessible server using an affected version of Bandit is at risk.
Technical details
The HTTP/1.1 chunked body reader in Bandit's 'Elixir.Bandit.HTTP1.Socket':read_data/2 function fails to enforce the caller-supplied :length option. While the Content-Length path correctly caps request sizes, the chunked encoding path in do_read_chunked_data!/5 buffers all received chunks into an iolist and materializes them as a single binary without checking against configured limits (such as Plug.Parsers' default 8MB). An unauthenticated attacker can send a single 'Transfer-Encoding: chunked' POST request with an arbitrarily large body to any path. This causes the BEAM process to exhaust available memory and be terminated by the OS Out-Of-Memory (OOM) killer. The vulnerability is reachable before routing or authentication in standard Phoenix/Plug configurations. The issue is fixed in version 1.11.1.
Affected products
- mtrudel bandit from 1.4.0 before 1.11.1
Timeline
- 2026-05-13: disclosed
- 2026-05-13: patched: Fixed in version 1.11.1
- 2026-05-13: advisory