The vulnerability arises from the function 'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex, which uses List.keyfind/3 and returns only the first Content-Length header value. If an HTTP request contains two Content-Length headers with different values, Bandit uses the first to read the body and treats the remaining bytes as a second request on the same keep-alive connection. This inconsistent interpretation enables HTTP request smuggling attacks, especially when Bandit is behind a proxy that selects the last Content-Length header and forwards the request. This can allow unauthenticated attackers to bypass edge WAF rules, path-based ACLs, rate limiting, and audit logging. The issue affects bandit versions before 1.11.0, including version 0.1.0 as explicitly stated.

An unauthenticated attacker can exploit this vulnerability to smuggle HTTP requests past security controls such as web application firewalls, access control lists, rate limiting, and audit logging. This can lead to unauthorized access, evasion of security policies, and potential further exploitation depending on the backend application behavior. The vulnerability does not require privileges or user interaction and has low vector complexity, but the overall impact is limited by the need for a proxy that handles Content-Length headers differently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider deploying additional proxy or WAF configurations that reject requests with multiple conflicting Content-Length headers or enforce strict HTTP request parsing according to RFC 9112 §6.3. Monitoring for anomalous HTTP request patterns involving duplicate Content-Length headers may help detect exploitation attempts.