CVE-2026-116078 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116078?
CVE-2026-116078 is a high-severity vulnerability in mtrudel bandit, published on 28 Oct 2026.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.
This issue affects bandit: from 0.3.1 before 1.14.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-116078?
1 open source package ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 0.3.1 | 1.14.1 |
How do I fix CVE-2026-116078?
Upgrade bandit to 1.14.1 or later.
Is CVE-2026-116078 being exploited?
There is no known exploitation of CVE-2026-116078 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-116078, GHSA-pxjf-g536-7r93, UBUNTU-CVE-2026-116078.