CVE-2026-111101
Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits or Throttling in Bandit

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader. This issue affects bandit: from 0.1.0 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-111101
EUVD
EUVD-2026-109824

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.1.0
mtrudel bandit 7201270c34b90f6c9e15c0386c2bb802c0c72ab4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the HTTP/1.1 chunked body reader of the Bandit web server library. An attacker can send many tiny 1-byte chunks in a request, causing the server to consume excessive memory and CPU. The server stores each chunk separately, leading to disproportionate resource usage compared to the actual data size.

Detection Guidance

Detect this vulnerability by monitoring for unusually high memory and CPU usage in processes running bandit versions before 1.14.0. Check for many small HTTP requests with chunked transfer encoding. Use system monitoring tools like top, htop, or ps to observe process resource consumption.

Impact Analysis

This vulnerability can cause denial-of-service by exhausting server resources. It may lead to slow performance, crashes, or downtime for services using affected versions of Bandit. Systems with limited resources are particularly vulnerable.

Mitigation Strategies

Upgrade bandit to version 1.14.0 or later to address the vulnerability. If immediate upgrade is not possible, restrict network access to the vulnerable service or implement rate limiting to reduce the impact of malicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111101. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart