HTTP/1 chunked body reader ignores length cap in bandit

Weakness Type (CWE)

CWE-770 — CWE-770 Allocation of Resources Without Limits or Throttling

CAPEC

CAPEC-130 — CAPEC-130 Excessive Allocation

CVSS 4.0 Score

8.7

HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.

The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.

Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.

The content-length path in the same function correctly enforces the limit and is not affected.

This issue affects bandit: from 1.4.0 before 1.11.1.

Affected

`pkg:hex/bandit`

Module	Source File	Routine
`Bandit.HTTP1.Socket`	`lib/bandit/http1/socket.ex`	`Bandit.HTTP1.Socket.read_data/2`
		`Bandit.HTTP1.Socket.do_read_chunked_data!/5`

Status	Type	Version	Changes / Fixed in
affected	semver ^ⓘ	`1.4.0`	< `1.11.1`

`pkg:github/mtrudel/bandit`

Module	Source File	Routine
`Bandit.HTTP1.Socket`	`lib/bandit/http1/socket.ex`	`Bandit.HTTP1.Socket.read_data/2`
		`Bandit.HTTP1.Socket.do_read_chunked_data!/5`

Status	Type	Version	Changes / Fixed in
affected	git ^ⓘ	`903e209a52`	< `ae3520dfdb`

References

https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2 vendor-advisory related
https://osv.dev/vulnerability/EEF-CVE-2026-39803 related
https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab patch

Credits

Finder: Peter Ullrich
Remediation developer: Mat Trudel
Analyst: Jonatan Männchen

CVE record as JSON: GET /cves/CVE-2026-39803.json
OSV record as JSON: GET /osv/EEF-CVE-2026-39803.json