The vulnerability CVE-2026-39803 in mtrudel bandit (versions 1.4.0 up to but not including 1.11.1) is due to the function 'Elixir.Bandit.HTTP1.Socket':read_data/2 ignoring the configured maximum length when reading HTTP/1 chunked request bodies. Instead of limiting the accumulated body size, the function buffers all chunks into memory unconditionally and materializes the entire body as a single binary. This behavior allows an unauthenticated remote attacker to send a chunked POST request with an arbitrarily large body, causing memory exhaustion and termination of the BEAM process by the OS out-of-memory killer. The vulnerability does not affect requests using content-length headers, which correctly enforce size limits. Because Plug.Parsers runs before routing and authentication, no valid route or credentials are needed to trigger this denial of service.

An unauthenticated remote attacker can cause a denial of service by exhausting server memory through a single crafted HTTP/1 chunked POST request with an arbitrarily large body. This leads to the termination of the BEAM process by the operating system's out-of-memory killer, resulting in service disruption. There is no indication of data disclosure or code execution. The impact is limited to denial of service via resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as limiting request sizes or blocking chunked transfer encoding requests from untrusted sources. Monitoring for unusually large chunked requests may help detect exploitation attempts. Avoid relying solely on application-level size limits for chunked bodies in affected versions.