PT-2026-36544 · Bandit · Bandit

Jonatan Männchen + 2 · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-42788

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.6 through 1.10.x

Description An issue in the deserialize/2 function within Elixir.Bandit.HTTP2.Frame allows unauthenticated memory exhaustion through oversized HTTP/2 frames. The system checks the SETTINGS MAX FRAME SIZE limit only after pattern-matching the payload size, requiring the entire frame body to be present in memory before the size guard is evaluated. This allows a peer to announce a frame length up to the 24-bit maximum (approximately 16 MiB), forcing the server to buffer the entire body regardless of the negotiated max frame size. An attacker maintaining multiple concurrent connections can cause significant memory pressure, leading to a denial of service.

Recommendations Update to version 1.11.0 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-42788

Affected Products

Bandit

References · 6

• 🔥 https://github.com/mtrudel/bandit/security/advisories/GHSA-q6v9-r226-v65f · Exploit
• https://github.com/mtrudel/bandit/commit/1e8e55966da9129016b73d32f0e1df4630e3b463 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42788 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-42788 · Vendor Advisory
• https://hex.pm/packages/bandit · Note
• https://cna.erlef.org/cves/CVE-2026-42788.html · Note