← Back to CVE Explorer

CVE-2026-39803

Full vulnerability record from the local CVENow database.

Description

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response. Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer. The content-length path in the same function correctly enforces the limit and is not affected. This issue affects bandit: from 1.4.0 before 1.11.1.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Analyzed
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-13 14:17:32.633000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-39803",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-13T14:17:32.633",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignación de recursos sin límites ni limitación en mtrudel bandit permite la denegación de servicio remota no autenticada mediante el agotamiento de la memoria.\n\nLa cláusula ’chunked’ de ’Elixir.Bandit.HTTP1.Socket’:read_data/2 en lib/bandit/http1/socket.ex ignora la opción :length proporcionada por el llamador al leer cuerpos de solicitud HTTP/1 ’chunked’. En lugar de limitar el cuerpo acumulado al límite configurado (por ejemplo, los 8 MB predeterminados de Plug.Parsers), do_read_chunked_data!/5 almacena en búfer cada fragmento recibido en una iolist incondicionalmente y materializa el cuerpo completo como un único binario. La función siempre devuelve {:ok, body, ...}, por lo que los llamadores no pueden interponer una respuesta 413.\n\nDebido a que Plug.Parsers se ejecuta antes del enrutamiento y la autenticación en el punto final estándar de Phoenix, un atacante no autenticado no necesita una ruta o credenciales válidas. El envío de una única solicitud POST ’Transfer-Encoding: chunked’ con un cuerpo arbitrariamente grande a cualquier ruta hace que el proceso BEAM agote la memoria disponible y sea terminado por el ’OOM killer’ del sistema operativo.\n\nLa ruta ’content-length’ en la misma función aplica correctamente el límite y no se ve afectada.\n\nEste problema afecta a bandit: desde la versión 1.4.0 hasta antes de la 1.11.1."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "mtrudel",
          "product": "bandit",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "bandit",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Bandit.HTTP1.Socket'"
          ],
          "programFiles": [
            "lib/bandit/http1/socket.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Bandit.HTTP1.Socket':read_data/2"
            },
            {
              "name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"
            }
          ],
          "repo": "https://github.com/mtrudel/bandit",
          "packageURL": "pkg:hex/bandit",
          "versions": [
            {
              "version": "1.4.0",
              "lessThan": "1.11.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mtrudel",
          "product": "bandit",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "mtrudel/bandit",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Bandit.HTTP1.Socket'"
          ],
          "programFiles": [
            "lib/bandit/http1/socket.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Bandit.HTTP1.Socket':read_data/2"
            },
            {
              "name": "'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5"
            }
          ],
          "repo": "https://github.com/mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "versions": [
            {
              "version": "903e209a521bc216b9f9065c01ae9a0cac2d5a10",
              "lessThan": "ae3520dfdbfab115c638f8c7f6f6b805db34e1ab",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:41:58.440838Z",
          "id": "CVE-2026-39803",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.4.0",
              "versionEndExcluding": "1.11.1",
              "matchCriteriaId": "74E94987-90D9-47B7-9473-24ABB26B8EB7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-39803.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39803",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}