CVE-2026-39803: mtrudel bandit denial of service via memory exhaustion in HTTP/1.1 chunked reader

CVE-2026-39803 · Severity: high · CVSS 7.5 · Published 2026-05-13

Bandit, a high-performance HTTP server for Elixir, contains a flaw in how it handles certain types of web requests. An unauthenticated attacker can send a specially crafted request that forces the server to consume all available system memory. This results in a complete crash of the application, causing a denial of service for all users. Because this occurs before the application checks user credentials, any publicly accessible server using an affected version of Bandit is at risk.

Technologies: Mat Trudel Bandit. Vendors: Mat Trudel.

Quick answers

Is CVE-2026-39803 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39803 being exploited in the wild.
How severe is CVE-2026-39803?
High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?
Mat Trudel Bandit >= 1.4.0, < 1.11.1, from 1.4.0 before 1.11.1.
Is there a fix for CVE-2026-39803?
A patch was published on 2026-05-13: Fixed in version 1.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39803 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39803?
Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HTTP/1.1 chunked body reader in Bandit's 'Elixir.Bandit.HTTP1.Socket':read_data/2 function fails to enforce the caller-supplied :length option. While the Content-Length path correctly caps request sizes, the chunked encoding path in do_read_chunked_data!/5 buffers all received chunks into an iolist and materializes them as a single binary without checking against configured limits (such as Plug.Parsers' default 8MB). An unauthenticated attacker can send a single 'Transfer-Encoding: chunked' POST request with an arbitrarily large body to any path. This causes the BEAM process to exhaust available memory and be terminated by the OS Out-Of-Memory (OOM) killer. The vulnerability is reachable before routing or authentication in standard Phoenix/Plug configurations. The issue is fixed in version 1.11.1.

Affected products

  • mtrudel bandit from 1.4.0 before 1.11.1

Identifiers

  • CVE-2026-39803
  • GHSA-9q9q-324x-93r2

Timeline

  • 2026-05-13: disclosed
  • 2026-05-13: patched: Fixed in version 1.11.1
  • 2026-05-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.