CVE-2026-39805 mtrudel CVE debrief

Who should care

Users of bandit before version 1.11.0 should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of bandit and verifying that any proxies or edge security measures are properly configured to handle duplicate Content-Length headers.

Technical summary

The vulnerability is caused by the 'Elixir.Bandit.Headers':get_content_length/1 function in lib/bandit/headers.ex using List.keyfind/3, which returns only the first matching header. When a request contains two Content-Length headers with different values, Bandit silently accepts it, uses the first value to read the body, and dispatches the remaining bytes as a second pipelined request on the same keep-alive connection. This is a violation of RFC 9112 §6.3, which requires recipients to treat this as an unrecoverable framing error.

Defensive priority

High

Recommended defensive actions

• Update bandit to version 1.11.0 or later
• Verify proxy configurations to ensure proper handling of duplicate Content-Length headers
• Monitor for suspicious traffic patterns that may indicate exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source references provide evidence of the vulnerability and its impact. However, further testing and verification are necessary to fully understand the scope of the issue and ensure that mitigations are effective.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.