bandit vulnerabilities

In the Elixir bandit library from 0.3.1 before 1.14.1, the HTTP/2 request body reader lacks resource limits, allowing an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. Routes whose Plug reads the request body, including those behind Plug.Parsers, are affected.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Affects bandit from 1.4.0 before 1.14.0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.

A vulnerability in the Bandit (Elixir) library allows an unauthenticated remote attacker to exhaust server memory via a fragmented WebSocket message made of many 1-byte continuation frames. The fragment reassembly does not limit the number of fragments, so memory usage can greatly exceed the configured limit.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP header integer parser allows an unauthenticated remote attacker to consume server CPU by sending a Content-Length value or Host/:authority port made of thousands of digits. The parser builds the number digit by digit without a length limit, resulting in quadratic time complexity.

An improper cleanup on thrown exception vulnerability in Bandit's HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits by sending multiple frames in a single TCP write, one of which raises a stream error. The connection state rolls back, causing streams to be forgotten and limits to be exceeded.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/1.1 chunked body reader allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The reader keeps every chunk as a separate term without limiting the number of chunks.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. The HPACK encoder table is resized to the client-advertised size without a server-side cap, causing O(N²) CPU cost for N responses.

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.

An improper handling of highly compressed data (data amplification) vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores a large cookie value in the HPACK dynamic table and references it many times, causing excessive memory allocation.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The server walks the entire queue of blocked sends for each frame, resulting in O(n²) list operations for n blocked streams.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker blocks the stream process and floods it with small DATA frames, which are queued until the BEAM node runs out of memory.

The bandit library (versions 0.6.0 to 1.13.0) improperly validates syntactic correctness of input. An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target, potentially injecting malicious values into URLs generated by the application.

In the mtrudel bandit library, an unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by trickling small WINDOW_UPDATE frames. Each partial progress resets deadlines, so the blocked stream process, its Plug state and held resources stay alive as long as the attacker keeps dripping, exhausting server processes and memory. This issue affects bandit from 1.4.0 before 1.13.0.

CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.

A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.

Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 terminates only when the last-chunk line is followed immediately by the empty trailer line, but RFC 9112 permits trailer fields between them. When trailers are present, the worker process is pinned for the lifetime of the TCP connection, and a handful of concurrent connections can exhaust the Bandit worker pool. This issue affects bandit from 1.6.1 before 1.11.1.

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies, buffering every received chunk unconditionally and materializing the entire body as a single binary. A single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer. This issue affects bandit from 1.4.0 before 1.11.1.

mtrudel bandit (from 0.3.6 before 1.11.0) has an Allocation of Resources Without Limits or Throttling vulnerability. deserialize/2 checks SETTINGS_MAX_FRAME_SIZE only after buffering the entire HTTP/2 frame body, allowing an unauthenticated attacker to exhaust memory with oversized frames.

A vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion, enabling unauthorized users to send an unbounded number of continuation frames. The issue occurs in the handle_frame/3 method, which lacks size limits for accumulated data.

mtrudel bandit (from 1.0.0 before 1.11.0) has a Reliance on Untrusted Inputs in a Security Decision vulnerability. determine_scheme/2 returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag, allowing unauthenticated transport-state spoofing on plaintext HTTP connections.

A vulnerability in the Bandit library (Elixir) allows HTTP request smuggling via duplicate Content-Length headers. The server accepts the first header and treats the remaining data as a subsequent request on the same connection.

The bandit library (mtrudel) versions 0.5.9 through 1.11.0 has an allocation of resources without limits vulnerability during WebSocket permessage-deflate decompression. The inflate/2 function calls :zlib.inflate/2 without an output-size cap, allowing an unauthenticated attacker to send a single highly compressed frame and exhaust the BEAM node's memory.