CVE-2026-39803
Published: 13 May 2026
Summary
CVE-2026-39803 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Mtrudel Bandit. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2026-39803 is an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in the Elixir Bandit web server. It affects versions 1.4.0 through 1.11.0. The root cause is in Elixir.Bandit.HTTP1.Socket:read_data/2, where the chunked request-body path in lib/bandit/http1/socket.ex ignores the caller-supplied :length limit (such as Plug.Parsers' default 8 MB) and unconditionally accumulates every chunk into an iolist before materializing the full body as a binary; the function always returns {:ok, body, ...} so no 413 response can be sent. The content-length code path correctly enforces the limit and is unaffected.
An unauthenticated remote attacker can trigger the flaw by sending a single HTTP/1 POST request containing the Transfer-Encoding: chunked header and an arbitrarily large body to any path. Because Plug.Parsers executes before routing or authentication in a standard Phoenix endpoint, the request reaches the vulnerable code without credentials or a valid route, causing the BEAM process to exhaust memory and be killed by the OS OOM killer, resulting in denial of service.
The published advisories and the fixing commit (ae3520dfdbfab115c638f8c7f6f6b805db34e1ab) recommend upgrading Bandit to 1.11.1 or later; the GitHub Security Advisory GHSA-9q9q-324x-93r2 and the Erlang Ecosystem Foundation CNA entry contain the same remediation guidance. The associated EPSS score has remained low and essentially flat (current 0.0140, peak 0.0141), indicating no material increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29950
Vulnerability details
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of…
more
capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response. Because Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer. The content-length path in the same function correctly enforces the limit and is not affected. This issue affects bandit: from 1.4.0 before 1.11.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to application exploitation causing endpoint DoS via unbounded chunked body buffering and memory exhaustion.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.
Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use.
Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages.
Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime.
Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling.
Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely.
Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks.
Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections.