CVE-2026-39806: DoS in Bandit HTTP1 Socket

The vulnerability stems from how Bandit's HTTP1 socket handles chunked data and trailers according to RFC 9112. Specifically, the doreadchunked_data! function incorrectly terminates when trailers are present, leading to an infinite loop and subsequent exhaustion of worker processes. A successful attack can render the Bandit service unavailable, preventing legitimate requests from being processed. This could impact applications relying on Bandit for outgoing HTTP requests, potentially causing cascading failures within the system. The blast radius is limited to the availability of the Bandit client itself, but the impact can be significant if Bandit is a critical component in the application architecture.

1. Reserved2026-04-07
2. Published2026-05-13

The primary mitigation is to upgrade Bandit to version ae3520dfdbfab115c638f8c7f6f6b805db34e1ab or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing rate limiting on incoming HTTP requests to the Bandit service to prevent a single attacker from overwhelming the worker processes. Additionally, configure a Web Application Firewall (WAF) to inspect HTTP/1.1 requests for unusually large trailer sections, which could indicate an attempted exploitation. There are no specific Sigma or YARA rules available at this time, but monitoring for excessive CPU usage by the Bandit worker processes is a good indicator of potential exploitation.