{"id":"UBUNTU-CVE-2026-116078","details":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as its own list element until the read returns. The :length option of read_body/2 counts body bytes, not frames, so a body of 1-byte frames costs a list cell and a binary term per byte. Interleaving the frames across up to 500 concurrent streams per connection keeps each stream consuming its frames as they arrive; in the reporter's test, 100 streams held 25 to 40 MiB of stream process memory for 5 MB sent. Only routes whose Plug reads the request body are affected, which includes any route behind Plug.Parsers. This issue affects bandit: from 0.3.1 before 1.14.1.","modified":"2026-10-29T20:04:29.386063842Z","published":"2026-10-29T00:00:00Z","upstream":["CVE-2026-116078"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-116078"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-116078"},{"type":"REPORT","url":"https://cna.erlef.org/cves/CVE-2026-116078.html"},{"type":"REPORT","url":"https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee"},{"type":"REPORT","url":"https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"},{"type":"REPORT","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93"},{"type":"REPORT","url":"https://osv.dev/vulnerability/EEF-CVE-2026-116078"}],"affected":[{"package":{"name":"bandit","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.2-1","0.13.2-3"],"ecosystem_specific":{"binaries":[{"binary_name":"bandit","binary_version":"0.13.2-3"},{"binary_name":"python-bandit","binary_version":"0.13.2-3"},{"binary_version":"0.13.2-3","binary_name":"python3-bandit"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-0ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4.0-0ubuntu2","binary_name":"bandit"},{"binary_version":"1.4.0-0ubuntu2","binary_name":"python-bandit"},{"binary_name":"python3-bandit","binary_version":"1.4.0-0ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-3","1.6.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"bandit","binary_version":"1.6.2-1"},{"binary_version":"1.6.2-1","binary_name":"python3-bandit"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"bandit","binary_version":"1.6.2-1"},{"binary_version":"1.6.2-1","binary_name":"python3-bandit"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2-3"],"ecosystem_specific":{"binaries":[{"binary_name":"bandit","binary_version":"1.6.2-3"},{"binary_name":"python3-bandit","binary_version":"1.6.2-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.10-3","1.9.4-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.9.4-1","binary_name":"bandit"},{"binary_name":"python3-bandit","binary_version":"1.9.4-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}},{"package":{"name":"bandit","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/bandit?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.10-2","1.7.10-3"],"ecosystem_specific":{"binaries":[{"binary_name":"bandit","binary_version":"1.7.10-3"},{"binary_name":"python3-bandit","binary_version":"1.7.10-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116078.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}