Skip to content
Threat Feed

Tag

Chunked-Transfer-Encoding

1 brief RSS
medium advisory

Bandit HTTP/1 Chunked Request Trailer Denial of Service

Bandit versions 1.6.0 through 1.11.0 are vulnerable to an unauthenticated denial-of-service (CVE-2026-39806) via a chunked request with trailers, where sending a request with `Transfer-Encoding: chunked` and a trailer field causes the connection's worker process to spin forever in an infinite recursion, exhausting the listener pool and rendering the server unresponsive.

bandit denial-of-service chunked-transfer-encoding
2r 1t 1c