CVE-2026-116078

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

CVE-2026-116078

The mtrudel bandit web server is vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in its HTTP/2 request body reader. The root cause is located in do_read_data/5 within lib/bandit/http2/stream.ex, which stores each incoming DATA frame payload as an indi...

CVE-2026-116078 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...

EUVD-2026-112087

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...