# CVE-2026-39806: mtrudel bandit infinite loop in HTTP/1 chunked decoder

Source: https://junglewise.ai/threats/cve-2026-39806-mtrudel-bandit-infinite-loop-in-http-1-chunked-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-39806 · Severity: high · CVSS 7.5 · Published 2026-05-13

Bandit is an Elixir-based web server used to handle HTTP traffic for applications like Phoenix and Plug. A flaw in how it processes certain types of data transfers (chunked encoding) allows an unauthenticated attacker to crash or freeze the server. By sending a small number of specially crafted requests, an attacker can exhaust the server's resources, making the application unavailable to legitimate users.

Technologies: [Mat Trudel Bandit](https://junglewise.ai/threats/technologies/bandit). Vendors: [Mat Trudel](https://junglewise.ai/threats/vendors/mat-trudel).

## Quick answers

**Is CVE-2026-39806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39806 being exploited in the wild.

**How severe is CVE-2026-39806?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** Mat Trudel Bandit >= 1.6.0, < 1.11.1, from 1.6.1 before 1.11.1.

**Is there a fix for CVE-2026-39806?** A patch was published on 2026-05-13: Fixed in version 1.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39806 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39806?** Check whether you run Mat Trudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 within lib/bandit/http1/socket.ex. The decoder fails to correctly handle RFC 9112-compliant chunked requests that include trailer fields. When a trailer is present after the last-chunk marker (0\r\n), the socket's match clauses fail to terminate, causing the code to compute a negative byte count and enter an infinite tail-recursion loop. This pins the worker process for the duration of the TCP connection. An attacker can exhaust the entire worker pool with a small number of concurrent connections, rendering the server unresponsive. The issue is fixed in version 1.11.1.

## Affected products

- mtrudel bandit from 1.6.1 before 1.11.1

## Identifiers

- CVE-2026-39806
- GHSA-rf5q-vwxw-gmrf

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: patched: Fixed in version 1.11.1
- 2026-05-13: advisory

## References

- [https://cna.erlef.org/cves/CVE-2026-39806.html](https://cna.erlef.org/cves/CVE-2026-39806.html)
- [https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab](https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab)
- [https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf](https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf)

## Related threats

- [mtrudel bandit denial of service in WebSocket fragment reassembly](https://junglewise.ai/threats/cve-2026-65623-mtrudel-bandit-denial-of-service-in-websocket-fragment-reassembly)
- [mtrudel bandit denial of service via memory exhaustion in HTTP/1.1 chunked reader](https://junglewise.ai/threats/cve-2026-39803-mtrudel-bandit-denial-of-service-via-memory-exhaustion-in-http-1)
- [mtrudel bandit HTTP request smuggling via duplicate Content-Length](https://junglewise.ai/threats/cve-2026-39805-mtrudel-bandit-http-request-smuggling-via-duplicate-content)