The vulnerability in mtrudel bandit occurs in the Elixir.Bandit.HTTP1.Socket module's do_read_chunked_data!/5 function, which mishandles chunked HTTP requests containing trailer fields. The function expects the last chunk line to be immediately followed by an empty trailer line, but RFC 9112 allows multiple trailer fields in between. When trailers are present, none of the pattern matches apply, leading to a recursive call with unchanged state and no progress, effectively causing an infinite loop. This pins the worker process for the duration of the TCP connection. Multiple concurrent connections with such requests can exhaust the worker pool, resulting in a denial of service. This affects bandit versions from 1.6.1 up to but not including 1.11.1.

An unauthenticated remote attacker can cause a denial of service by sending a small number of concurrent chunked HTTP requests containing trailer fields. This exhausts the server's worker pool by pinning worker processes in an infinite loop, rendering the server unresponsive to legitimate traffic. Servers behind proxies that forward trailer-bearing requests (e.g., NGINX, HAProxy) may be affected even without malicious client activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating by limiting or filtering HTTP requests with chunked transfer encoding containing trailer fields at the proxy or firewall level to prevent triggering the infinite loop condition. Monitor for updates from the mtrudel bandit project regarding patches or official workarounds.