CVE-2026-39806: DoS in Bandit HTTP1 Socket

The primary impact of CVE-2026-39806 is a denial-of-service. An attacker can trigger this vulnerability by sending specially crafted HTTP/1.1 requests with trailers. RFC 9112 permits trailers between the last-chunk line and the empty trailer line, but Bandit's implementation fails to handle this correctly, leading to an infinite loop. This loop consumes resources and eventually exhausts the available worker processes, preventing legitimate requests from being processed. The blast radius is limited to the affected Bandit instance, but widespread exploitation could impact multiple services relying on Bandit as a proxy. This vulnerability is similar in impact to other HTTP proxy DoS vulnerabilities, where crafted requests are used to overwhelm server resources.

1. Reserviert2026-04-07
2. Veröffentlicht2026-05-13

The recommended mitigation for CVE-2026-39806 is to upgrade Bandit to version ae3520dfdbfab115c638f8c7f6f6b805db34e1ab or later. If upgrading is not immediately feasible, consider implementing rate limiting on incoming HTTP/1.1 requests to mitigate the impact of potential exploitation. Additionally, deploying a Web Application Firewall (WAF) with rules to filter out requests containing excessive or malformed trailers could provide a temporary layer of protection. Monitor Bandit's resource usage (CPU, memory) for unusual spikes, which could indicate an ongoing attack. After upgrade, confirm by sending a valid HTTP/1.1 request with trailers and verifying that the worker processes remain stable.