mtrudel bandit 1.11.0/1.13.9 WebSocket Fragment Reassembly allocation of resources

Summaryinfo

A vulnerability classified as problematic has been found in mtrudel bandit 1.11.0/1.13.9. The impacted element is an unknown function of the component WebSocket Fragment Reassembly. Performing a manipulation results in allocation of resources. This vulnerability is identified as CVE-2026-114213. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in mtrudel bandit 1.11.0/1.13.9. This affects some unknown processing of the component WebSocket Fragment Reassembly. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout. This issue affects bandit: from 1.11.0 before 1.14.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-114213 since 10/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• mtrudel

Name

• bandit

Version

• 1.11.0
• 1.13.9

Website

• Product: https://github.com/mtrudel/bandit/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion