CVE-2026-108525High· 8.7▾ TwilightAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.
Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.
This issue affects bandit: from 0.3.1 before 1.14.0.
bandit >= 0.3.1 < 1.14.0mtrudel/bandit >= c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f < 220b9dfd27f9a21305be2afc75cbe585ddc24e7aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115269High· 8.7HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-114213High· 8.7WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-110499High· 8.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
CVE-2026-111101High· 8.7HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-114216Medium· 6.3Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314Medium· 6.3WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit