CVE-2026-105659

8.7High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.7High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400

Impact

Remote unauthenticated attackers can exhaust server memory and process limits by holding HTTP/2 streams open indefinitely. They only need network access to send trickling WINDOW_UPDATE or SETTINGS frames to an exposed Bandit port.

Root cause

Bandit resets the 15-second response deadline whenever partial progress is made on a send, allowing tiny frame updates to perpetually re-arm timeouts and trap active stream processes.

Affected systems

mtrudel bandit 1.4.0 onward

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade bandit to the patched release containing commits d88b21953c65061f21136ea76a89a4f95a2ac7a1 and fff06efe3be962b484bd4d3eb339372fda5a231f (check advisory GHSA-69m6-wcv4-rwcf for the exact release tag). As an interim mitigation, disable HTTP/2 support or place an unaffected reverse proxy in front to handle HTTP/2 termination.

shell

$ mix deps.update bandit

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-105659