CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

UBUNTU-CVE-2026-111101

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

UBUNTU-CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-111101 HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

EEF-CVE-2026-111101 HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket....

CVE-2026-111101

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

EUVD-2026-109824

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

CVE-2026-111101 HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

EEF-CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. Th...

EUVD-2026-109820

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-114216

The mtrudel bandit web framework (versions 1.12.4 before 1.14.0 ) is vulnerable to an HTTP Request Smuggling attack due to an inconsistent interpretation of HTTP/1.1 chunked bodies in lib/bandit/http1/socket.ex. The chunked body reader fails to validate the chunk-ext grammar against RFC 9112 , al...

CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

PT-2026-123307

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

EUVD-2026-105995

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http1. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful...

CVE-2026-101587

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webclient-http1. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful...

CVE-2026-101587

A vulnerability exists in the helidon-webclient-http1 component of the Helidon product within Oracle Fusion Middleware . The affected versions are 4.0.0-4.5.5 and 27.0.0 . An unauthenticated attacker with network access via HTTP can exploit this flaw to cause a partial denial of service (partial ...

io.helidon.bundles:helidon-bundles-security (>=27.0.0-m1, <=27.0.0), io.helidon.extensions.eureka:helidon-extensions-eureka (27.0.0) +41 more potentially affected by CVE-2026-101587 via io.helidon.webclient:helidon-webclient-http1 (>=27.0.0-m1, <=27.0.0)

io.helidon.webclient:helidon-webclient-http1 MAVEN version =27.0.0-m1, =27.0.0-m1, =27.0.0 - io.helidon.extensions.eureka:helidon-extensions-eureka 27.0.0 - io.helidon.extensions.eureka:helidon-extensions-eureka-discovery 27.0.0 -...