# CVE-2026-39805: mtrudel bandit HTTP request smuggling via duplicate Content-Length

Source: https://junglewise.ai/threats/cve-2026-39805-mtrudel-bandit-http-request-smuggling-via-duplicate-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39805 · Severity: info · CVSS 6.3 · Published 2026-05-01

Bandit, a high-performance web server for the Elixir programming language, is vulnerable to a request smuggling flaw. When the server receives a request with multiple 'Content-Length' headers, it incorrectly processes only the first one instead of rejecting the request as required by web standards. This allows an attacker to hide a second, unauthorized request inside a legitimate one, potentially bypassing security filters, firewalls, or access controls.

Technologies: [Mat Trudel Bandit](https://junglewise.ai/threats/technologies/bandit). Vendors: [Mat Trudel](https://junglewise.ai/threats/vendors/mat-trudel).

## Quick answers

**Is CVE-2026-39805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39805 being exploited in the wild.

**How severe is CVE-2026-39805?** Informational severity, with a CVSS score of 6.3, published 1 May 2026.

**Which products and versions are affected?** Mat Trudel Bandit < 1.11.0.

**Is there a fix for CVE-2026-39805?** A patch was published on 2026-05-01: Version 1.11.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39805 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39805?** Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in 'Elixir.Bandit.Headers':get_content_length/1 within lib/bandit/headers.ex, which utilizes List.keyfind/3 to retrieve the Content-Length header. Because List.keyfind/3 only returns the first occurrence, Bandit fails to detect and reject requests containing multiple, conflicting Content-Length headers as required by RFC 9112 §6.3. If Bandit is deployed behind a proxy that prioritizes the last Content-Length header, an unauthenticated attacker can craft a request where the trailing bytes are interpreted by Bandit as a separate, pipelined request. This enables the smuggling of requests past WAFs, ACLs, and rate limiters. The issue is resolved in version 1.11.0.

## Affected products

- mtrudel bandit < 1.11.0

## Timeline

- 2026-05-01: advisory: GHSA-c67r-gc9j-2qf7 published
- 2026-05-01: patched: Version 1.11.0 released

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-39805.html](https://cna.erlef.org/cves/CVE-2026-39805.html)
- [https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1](https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1)
- [https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7](https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7)

## Related threats

- [mtrudel bandit denial of service in WebSocket fragment reassembly](https://junglewise.ai/threats/cve-2026-65623-mtrudel-bandit-denial-of-service-in-websocket-fragment-reassembly)
- [mtrudel bandit infinite loop in HTTP/1 chunked decoder](https://junglewise.ai/threats/cve-2026-39806-mtrudel-bandit-infinite-loop-in-http-1-chunked-decoder)
- [mtrudel bandit denial of service via memory exhaustion in HTTP/1.1 chunked reader](https://junglewise.ai/threats/cve-2026-39803-mtrudel-bandit-denial-of-service-via-memory-exhaustion-in-http-1)