The vulnerability arises in the Elixir.Bandit.HTTP1.Socket module's do_read_chunked_data!/5 function, which expects the last chunk line (0\r\n) to be immediately followed by an empty trailer line (\r\n). However, RFC 9112 permits zero or more trailer fields between these lines. When trailers are present, the function's pattern matching fails, causing a catch-all clause to compute a negative to_read value and recursively call read_available!/2 without progressing. This results in an infinite loop that pins the worker process for the duration of the TCP connection. Multiple concurrent connections with trailer-bearing chunked requests can exhaust the Bandit worker pool, making the server unresponsive. This affects bandit versions from 1.6.1 up to but not including 1.11.1.

An unauthenticated remote attacker or even legitimate clients/proxies sending RFC-compliant chunked requests with trailer fields can cause worker process exhaustion, resulting in a denial of service condition. The server becomes unresponsive to further traffic due to all worker processes being pinned in infinite loops. No special privileges or large payloads are required to trigger the issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, consider limiting or filtering requests with trailer fields at upstream proxies if feasible to reduce exposure.