Most recent entries from all

certfr-2026-avi-0846 — De multiples vulnérabilités ont été découvertes dans les produits HPE Aruba Networking. Elles permettent à un attaquant…

certfr-2026-avi-0846

EUVD-2026-322111

fkie_cve-2026-39806

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.

'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 in lib/bandit/http1/socket.ex terminates only when the last-chunk line 0\r\n is followed immediately by the empty trailer line \r\n. RFC 9112 §7.1.2 permits zero or more trailer fields between them. When trailers are present, none of the match clauses fit: the catch-all arm computes a negative to_read, calls read_available!/2, receives <<>> on timeout, and tail-recurses with unchanged state. The worker process is pinned for the lifetime of the TCP connection.

A handful of concurrent connections sending RFC-conformant chunked requests with trailer fields is sufficient to exhaust the Bandit worker pool and render the server unresponsive to all further traffic. No authentication, special headers, or large payload is required. Proxies such as NGINX and HAProxy legitimately forward trailer-bearing requests, so servers behind such proxies may be affected without any malicious client involvement.

This issue affects bandit: from 1.6.1 before 1.11.1.

GHSA-rf5q-vwxw-gmrf — Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder

Affected: Hex: bandit

### Summary A worker-pinning denial of service in Bandit's HTTP/1 chunked transfer decoder. Any unauthenticated client that sends a `Transfer-Encoding: chunked` request whose body ends with a trailer field (RFC 9112 §7.1.2 explicitly permits this) causes the connection's worker process to spin forever in an infinite recursion. A handful of concurrent connections are sufficient to exhaust the listener pool and render the server unresponsive to all further traffic.

The vulnerability was likely introduced with this commit on `Dec 6, 2024`: https://github.com/mtrudel/bandit/commit/e73e379ab59840e8561b5730878f16e29ab06217

### Details The bug is in `lib/bandit/http1/socket.ex` in `do_read_chunked_data!/5` (around lines 242–274). The terminator clause matches only `["0", "\r\n" <> rest]` — i.e. the last-chunk line `0\r\n` followed *immediately* by the empty trailer line. RFC 9112 §7.1.2 allows zero or more trailer fields between `0\r\n` and the final `\r\n`, e.g. a body ending `0\r\nX-T: v\r\n\r\n`.

When trailers are present, `:binary.split/2` returns `["0", "X-T: v\r\n\r\n"]`. The terminator clause does not match. The inner `<<_::binary-size(0), ?\r, ?\n, _::binary>>` pattern also does not match because `rest` starts with `X`. Execution falls into the `_ ->` arm, which computes `to_read = 0 - byte_size(rest)` (a negative number) and calls `read_available!/2` on the socket. On timeout, `read_available!/2` returns `<<>>`, leaving the buffer unchanged. `do_read_chunked_data!/5` th…