The vulnerability arises from the Elixir.Bandit.Headers module's get_content_length/1 function, which uses List.keyfind/3 to retrieve only the first Content-Length header in an HTTP request. When two Content-Length headers with differing values are present, Bandit reads the body based on the first header and treats the remaining bytes as a separate pipelined request on the same keep-alive connection. According to RFC 9112 §6.3, this should be treated as an unrecoverable framing error, but Bandit does not enforce this. If Bandit is deployed behind a proxy that selects the last Content-Length header and forwards the request, an attacker can exploit this discrepancy to smuggle HTTP requests past edge security mechanisms, potentially bypassing protections such as WAF rules, path-based ACLs, rate limiting, and audit logging. This issue affects all versions of bandit prior to 1.11.0. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack and impact requirements, and no privileges or user interaction needed.

An unauthenticated attacker can exploit this vulnerability to perform HTTP request smuggling by sending crafted requests with duplicate Content-Length headers. This can lead to bypassing security controls such as web application firewalls, access control lists, rate limiting, and audit logging when Bandit is used behind a proxy that interprets the Content-Length headers differently. The discrepancy in header interpretation can allow malicious requests to be processed undetected or unauthorized requests to reach backend services. There is no indication of direct code execution or data leakage from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider deploying Bandit behind proxies or gateways that strictly enforce RFC 9112 §6.3 and reject requests with multiple conflicting Content-Length headers. Additionally, reviewing proxy and WAF configurations to ensure consistent interpretation of HTTP headers can help mitigate exploitation. Monitor vendor channels for updates regarding an official patch or workaround.