CVE-2026-114216
Awaiting Analysis Awaiting Analysis - Queue

Bandit HTTP Request Smuggling Vulnerability

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected. This issue affects bandit: from 1.12.4 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-114216
EUVD
EUVD-2026-109820

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 1.12.4
mtrudel bandit c31e9e3c76dcbfc239a96eabed5341ced7885ae5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an HTTP request smuggling vulnerability in the Bandit HTTP/1.1 server. It occurs because Bandit's chunked body reader incorrectly processes chunk extensions in HTTP requests, accepting bare LF or CR characters which violates RFC 9112 standards. This allows an attacker to smuggle a second HTTP request past a front-end proxy by embedding a malicious chunk extension containing a bare LF.

Detection Guidance

To detect this vulnerability, inspect HTTP traffic for malformed chunked transfer encoding requests. Use tools like tcpdump or Wireshark to capture and analyze HTTP/1.1 requests with chunk extensions containing bare LF or CR characters. Check if Bandit versions between 1.12.4 and 1.14.0 are deployed by running: `mix deps | grep bandit` or checking your dependency file.

If you use a proxy in front of Bandit, test for inconsistent request parsing by sending crafted chunked requests with extensions like `3;\nGET /admin HTTP/1.1\r\nHost: example.com` and observe if the proxy forwards them as one request while Bandit splits them.

Impact Analysis

An attacker could bypass proxy access controls to access restricted paths like /admin or execute unauthorized actions. This works when a proxy treats a malicious chunked request as one request while Bandit splits it into two separate pipelined requests. Deployments without a proxy in front of Bandit are not affected.

Mitigation Strategies

Upgrade Bandit to version 1.14.0 or later immediately. If upgrading is not possible, disable HTTP/1 support by setting `http_1_options: [enabled: false]` in your Bandit configuration to force HTTP/2 usage.

If you cannot upgrade or disable HTTP/1, ensure your front-end proxy is configured to reject requests with malformed chunk extensions or bare LF/CR characters in chunk-size lines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart