PT-2026-40608 · Bandit · Bandit

Jonatan Männchen + 2 · Published 2026-05-13 · Updated 2026-05-19 · CVE-2026-39806

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bandit versions 1.6.1 through 1.11.0

Description An infinite loop in the do read chunked data!/5 function within lib/bandit/http1/socket.ex allows unauthenticated remote attackers to cause a denial of service via worker process exhaustion. The issue occurs because the function only terminates when the last-chunk line is immediately followed by an empty trailer line, whereas RFC 9112 §7.1.2 allows for zero or more trailer fields. When trailers are present, the process enters a state where it tail-recurses with unchanged state, pinning the worker process for the duration of the TCP connection. A small number of concurrent RFC-conformant chunked requests containing trailer fields can exhaust the worker pool, rendering the server unresponsive. This can occur even with legitimate traffic forwarded by proxies like NGINX and HAProxy.

Recommendations Update bandit to version 1.11.1.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-39806

GHSA-RF5Q-VWXW-GMRF

Affected Products

Bandit

References · 9

• 🔥 https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf · Exploit
• https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab · Patch
• https://osv.dev/vulnerability/GHSA-rf5q-vwxw-gmrf · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-39806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39806 · Security Note
• https://github.com/mtrudel/bandit · Note
• https://hex.pm/packages/bandit · Note
• https://twitter.com/VulmonFeeds/status/2054606886792548678 · Twitter Post
• https://cna.erlef.org/cves/CVE-2026-39806.html · Note