CVE-2026-39805: CL.CL HTTP Request Smuggling in Bandit Web Server

Vulnerability ID: CVE-2026-39805

CVSS Score: 6.3

Published: 2026-05-07

The Bandit HTTP server for Elixir versions prior to 1.11.0 fails to correctly process requests containing multiple Content-Length headers. This inconsistent interpretation creates a CL.CL HTTP request smuggling vulnerability when Bandit is deployed behind a reverse proxy that parses the headers differently. Attackers exploit this desynchronization to smuggle secondary HTTP requests past edge security controls.

TL;DR

Bandit < 1.11.0 accepts duplicate Content-Length headers and processes only the first one, violating RFC 9112.…