Is CVE-2026-39805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39805 being exploited in the wild.

How severe is CVE-2026-39805?

Informational severity, with a CVSS score of 6.3, published 1 May 2026.

Is there a fix for CVE-2026-39805?

A patch was published on 2026-05-01: Version 1.11.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39805 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39805?

Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39805: mtrudel bandit HTTP request smuggling via duplicate Content-Length

CVE-2026-39805 · Severity: info · CVSS 6.3 · Published 2026-05-01

Bandit, a high-performance web server for the Elixir programming language, is vulnerable to a request smuggling flaw. When the server receives a request with multiple 'Content-Length' headers, it incorrectly processes only the first one instead of rejecting the request as required by web standards. This allows an attacker to hide a second, unauthorized request inside a legitimate one, potentially bypassing security filters, firewalls, or access controls.

Technologies: Mat Trudel Bandit. Vendors: Mat Trudel.

Quick answers

Is CVE-2026-39805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39805 being exploited in the wild.
How severe is CVE-2026-39805?: Informational severity, with a CVSS score of 6.3, published 1 May 2026.
Which products and versions are affected?: Mat Trudel Bandit < 1.11.0.
Is there a fix for CVE-2026-39805?: A patch was published on 2026-05-01: Version 1.11.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39805 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39805?: Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in 'Elixir.Bandit.Headers':get_content_length/1 within lib/bandit/headers.ex, which utilizes List.keyfind/3 to retrieve the Content-Length header. Because List.keyfind/3 only returns the first occurrence, Bandit fails to detect and reject requests containing multiple, conflicting Content-Length headers as required by RFC 9112 §6.3. If Bandit is deployed behind a proxy that prioritizes the last Content-Length header, an unauthenticated attacker can craft a request where the trailing bytes are interpreted by Bandit as a separate, pipelined request. This enables the smuggling of requests past WAFs, ACLs, and rate limiters. The issue is resolved in version 1.11.0.

Affected products

mtrudel bandit < 1.11.0

Timeline

2026-05-01: advisory: GHSA-c67r-gc9j-2qf7 published
2026-05-01: patched: Version 1.11.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.