# CVE-2026-39803: mtrudel bandit denial of service via memory exhaustion in HTTP/1.1 chunked reader

Source: https://junglewise.ai/threats/cve-2026-39803-mtrudel-bandit-denial-of-service-via-memory-exhaustion-in-http-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-39803 · Severity: high · CVSS 7.5 · Published 2026-05-13

Bandit, a high-performance HTTP server for Elixir, contains a flaw in how it handles certain types of web requests. An unauthenticated attacker can send a specially crafted request that forces the server to consume all available system memory. This results in a complete crash of the application, causing a denial of service for all users. Because this occurs before the application checks user credentials, any publicly accessible server using an affected version of Bandit is at risk.

Technologies: [Mat Trudel Bandit](https://junglewise.ai/threats/technologies/bandit). Vendors: [Mat Trudel](https://junglewise.ai/threats/vendors/mat-trudel).

## Quick answers

**Is CVE-2026-39803 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39803 being exploited in the wild.

**How severe is CVE-2026-39803?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** Mat Trudel Bandit >= 1.4.0, < 1.11.1, from 1.4.0 before 1.11.1.

**Is there a fix for CVE-2026-39803?** A patch was published on 2026-05-13: Fixed in version 1.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39803 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39803?** Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HTTP/1.1 chunked body reader in Bandit's 'Elixir.Bandit.HTTP1.Socket':read_data/2 function fails to enforce the caller-supplied :length option. While the Content-Length path correctly caps request sizes, the chunked encoding path in do_read_chunked_data!/5 buffers all received chunks into an iolist and materializes them as a single binary without checking against configured limits (such as Plug.Parsers' default 8MB). An unauthenticated attacker can send a single 'Transfer-Encoding: chunked' POST request with an arbitrarily large body to any path. This causes the BEAM process to exhaust available memory and be terminated by the OS Out-Of-Memory (OOM) killer. The vulnerability is reachable before routing or authentication in standard Phoenix/Plug configurations. The issue is fixed in version 1.11.1.

## Affected products

- mtrudel bandit from 1.4.0 before 1.11.1

## Identifiers

- CVE-2026-39803
- GHSA-9q9q-324x-93r2

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: patched: Fixed in version 1.11.1
- 2026-05-13: advisory

## References

- [https://cna.erlef.org/cves/CVE-2026-39803.html](https://cna.erlef.org/cves/CVE-2026-39803.html)
- [https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab](https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab)
- [https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2](https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2)

## Related threats

- [mtrudel bandit denial of service in WebSocket fragment reassembly](https://junglewise.ai/threats/cve-2026-65623-mtrudel-bandit-denial-of-service-in-websocket-fragment-reassembly)
- [mtrudel bandit infinite loop in HTTP/1 chunked decoder](https://junglewise.ai/threats/cve-2026-39806-mtrudel-bandit-infinite-loop-in-http-1-chunked-decoder)
- [mtrudel bandit HTTP request smuggling via duplicate Content-Length](https://junglewise.ai/threats/cve-2026-39805-mtrudel-bandit-http-request-smuggling-via-duplicate-content)