CVE-2026-39803: DoS in Bandit HTTP1 Socket

The core of the vulnerability lies in the doreadchunked_data!/5 function within Bandit's HTTP/1 socket handling. Instead of respecting a configured length limit, it unconditionally accumulates all received chunks into a single binary, regardless of size. An attacker can leverage this by sending a series of oversized chunked HTTP/1 requests. Each chunk is added to the accumulating binary, eventually leading to memory exhaustion on the server. This can cause Bandit to crash, become unresponsive, or significantly degrade performance, effectively denying service to legitimate users. The unauthenticated nature of the vulnerability means an attacker doesn't need credentials to trigger the DoS condition, widening the potential attack surface.

1. Reserved2026-04-07
2. Published2026-05-13

The primary mitigation for CVE-2026-39803 is to upgrade Bandit to version ae3520dfdbfab115c638f8c7f6f6b805db34e1ab or later. This version includes a fix that enforces the configured length limit when reading chunked HTTP/1 request bodies, preventing uncontrolled memory consumption. If an immediate upgrade is not possible, consider implementing rate limiting on incoming HTTP/1 requests to reduce the impact of potential attacks. Web application firewalls (WAFs) configured to detect and block oversized HTTP requests can also provide a temporary layer of protection. There are no specific Sigma or YARA rules available at this time, but monitoring memory usage on Bandit servers is recommended.