CVE-2026-114216Medium· 6.3▾ SunlitInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.
The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.
This issue affects bandit: from 1.12.4 before 1.14.0.
bandit >= 1.12.4 < 1.14.0mtrudel/bandit >= c31e9e3c76dcbfc239a96eabed5341ced7885ae5 < 220b9dfd27f9a21305be2afc75cbe585ddc24e7aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Where the front-end proxy can reach Bandit over HTTP/2, disable HTTP/1 with http_1_options: [enabled: false], so that the chunked body reader never runs.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110314Medium· 6.3WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
CVE-2026-115269High· 8.7HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-108525High· 8.7HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584High· 8.7HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
CVE-2026-113436High· 8.7Quadratic bignum parsing of Content-Length and Host port values in Bandit