{"schema":"threatline.record/2","record":{"id":"CVE-2026-116078","aliases":["GHSA-pxjf-g536-7r93"],"summary":"HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit","details":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.\n\ndo_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers.\n\nThis issue affects bandit: from 0.3.1 before 1.14.1.","categories":["Unclassified"],"product":"bandit","vendor":"mtrudel","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116078","source_modified_at":"2026-10-28T13:26:25.372Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"bandit","vendor":"mtrudel","versions":[{"lessThan":"1.14.1","status":"affected","version":"0.3.1","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116078","source_modified_at":"2026-10-28T13:26:25.372Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"bandit","vendor":"mtrudel","versions":[{"lessThan":"327bb02ff84171237e1aeff787930debd16155ee","status":"affected","version":"c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116078","source_modified_at":"2026-10-28T13:26:25.372Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"bandit","ecosystem":null},"version":"1.14.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116078","source_modified_at":"2026-10-28T13:26:25.372Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"bandit","ecosystem":null},"version":"327bb02ff84171237e1aeff787930debd16155ee","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T13:26:25.372Z","modified_at":"2026-10-28T13:26:25.372Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116078","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T13:26:25.372Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93","tags":["vendor-advisory","related"]},{"source":"CVE List","url":"https://cna.erlef.org/cves/CVE-2026-116078.html","tags":["related"]},{"source":"CVE List","url":"https://osv.dev/vulnerability/EEF-CVE-2026-116078","tags":["related"]},{"source":"CVE List","url":"https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f","tags":["related"]},{"source":"CVE List","url":"https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T13:26:25.372Z","content_hash":"fd406dd01629dda0d21bb0195eb249ea2637feff45b10eefbf25f77804a3ec8c"}}