ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116078

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · HTTP/2 request bodies made

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116078. EPSS is 0.49%. Act only if a listed version of HTTP/2 request bodies made is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (HTTP/2 request bodies made).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High8.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.49%
Remediation
Advisory link
Affected products
Hex bandit · vendor mtrudel bandit

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. in keeps every DATA frame payload as its own list element until the read returns. The option of counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind . This issue affects bandit: from 0.3.1 before 1.14.1. ## Details **1. Per-frame accumulation.** calls in , which prepends each payload to a list ( ) and reverses it when the read returns. Each 1-byte payload arrives as a separate message from the connection process, so the stream heap holds a cons cell and a heap binary per frame. **2. Byte-only limit.** (default 8,000,000) is decremented by and bounds body bytes, not the number of frames. A read ends at or at its deadline, and 1-byte frames add no measurable deadline credit, so a stream holds whatever arrives within the deadline at the per-frame overhead ratio. answers 413 on , and the client continues on a new stream. **3. Interleaving defeats connection buffering.** The connection buffers DATA for a stream only once that stream has 16 messages outstanding. A stream that keeps up never reaches this, and interleaving one frame per stream per round across many streams keeps every stream under it regardless of TCP segment size. **4. Measurements on 1.14.0.** 100 streams of 5,000 interleaved 1-byte frames (5,000,000 bytes on the wire, 488 KiB of body) held 25 to 40 MiB in stream processes, with empty mailboxes. One stream of 60,000 frames sent one per write held 2 to

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex bandit0.3.1 → 1.14.1
  • vendor mtrudel banditversion unspecified

How to fix CVE-2026-116078

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116078. EPSS is 0.49%. Act only if a listed version of HTTP/2 request bodies made is installed.

Which versions are affected?

Compare what you have installed with 0.3.1 → 1.14.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.49%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2026 · GitHub Advisory Database

    Detected

    ## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. in keeps every DATA frame payload as its own list element until the read returns. The option of counts body bytes, not frames, so a body of 1-byte fram

  2. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    bandit fixed in 1.14.1

  3. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    bandit fixed in 1.14.1

  4. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. in keeps every DATA frame payload as its own list element until the read returns. The option of counts body bytes, not frames, so a body of 1-byte fram

Sources

  • CVE.orgVulnerability recordCVE-2026-116078

    Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-116078

    30-day exploitation probability 0.49%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-pxjf-g536-7r93

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-116078

    HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

    osv.dev

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 4, 2026
  • GitHub Advisory DatabaseNov 2, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • CVE.orgOct 29, 2026