Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a denial of service in Bandit's HTTP/1 chunked transfer decoder. The root cause lies in the do_read_chunked_data! function in lib/bandit/http1/socket.ex. A change introduced in commit e73e379ab59840e8561b5730878f16e29ab06217 altered the pattern matching for the end of a chunked stream. The new pattern did not account for the presence of trailer headers, which are permitted by RFC 9112. When a request with trailers is received, the pattern matching fails, and the function enters an infinite recursive loop.
This infinite loop is enabled by the read_available! function, which, in its vulnerable form, returns an empty binary on a socket read timeout. This causes do_read_chunked_data! to recurse with an unchanged state, pinning a worker process and leading to resource exhaustion.
The fix, implemented in commit ae3520dfdbfab115c638f8c7f6f6b805db34e1ab, addresses the issue by completely refactoring the chunk parsing logic in do_read_chunked_data! to correctly handle trailers and by modifying read_available! to raise an error on timeout, thus preventing the infinite loop. Any Bandit-fronted HTTP/1 service that accepts chunked request bodies is affected, and the vulnerability can be triggered by an unauthenticated attacker with a small number of crafted requests.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bandit | erlang | >= 1.6.0, < 1.11.1 | 1.11.1 |
