{"id":"CVE-2026-114216","aliases":[],"cve":{"records":[{"id":"CVE-2026-114216","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T10:45:02.529Z","published":"2026-10-26T13:30:41.225Z","modified":"2026-10-26T15:35:51.933Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-26T13:30:41.225Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T15:35:51.933Z"}],"references":[{"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-w5wc-g2hc-g7m2","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-114216.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-114216","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/c31e9e3c76dcbfc239a96eabed5341ced7885ae5","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a","tags":["patch"],"source":"EEF"}],"weaknesses":[{"id":"CWE-444","description":"CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"1.12.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T15:03:20.382433Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit","titleSource":"EEF","descriptionSource":"EEF","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF.\n\nThe chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\\nxx\\r\\n40\\r\\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.\n\nThis issue affects bandit: from 1.12.4 before 1.14.0.","score":6.3,"severity":"medium","published":"2026-10-26T13:30:41.225Z","modified":"2026-10-26T15:35:51.933Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"1.12.4","status":"affected","lessThan":"1.14.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/bandit","packageIdentity":{"ecosystem":"Hex","name":"bandit"},"cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-114216"},{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"c31e9e3c76dcbfc239a96eabed5341ced7885ae5","status":"affected","lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/mtrudel/bandit","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-114216"}],"remediation":[{"text":"Where the front-end proxy can reach Bandit over HTTP/2, disable HTTP/1 with http_1_options: [enabled: false], so that the chunked body reader never runs.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-114216"}],"references":["https://github.com/mtrudel/bandit/security/advisories/GHSA-w5wc-g2hc-g7m2","https://cna.erlef.org/cves/CVE-2026-114216.html","https://osv.dev/vulnerability/EEF-CVE-2026-114216","https://github.com/mtrudel/bandit/commit/c31e9e3c76dcbfc239a96eabed5341ced7885ae5","https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"],"sources":[{"name":"CVE","id":"CVE-2026-114216","modified":"2026-10-26T15:35:51.933Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114216"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","score":6.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:33:41.141Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:15:31.262Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Bandit versions 1.12.4 before 1.14.0 have an HTTP Request Smuggling vulnerability, allowing an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension with a bare LF. This issue affects deployments with a proxy in front of Bandit. The weakness is due to inconsistent interpretation of HTTP requests.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:38:01.406Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114216"}]}}