CVE-2026-105659
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the mtrudel bandit library, an unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by trickling small WINDOW_UPDATE frames. Each partial progress resets deadlines, so the blocked stream process, its Plug state and held resources stay alive as long as the attacker keeps dripping, exhausting server processes and memory. This issue affects bandit from 1.4.0 before 1.13.0.
Risk Assessment
An attacker can exhaust server resources (processes and memory), causing denial of service for applications using bandit.
Recommendation
Update the bandit library to version 1.13.0 or later.
Other vulnerabilities in bandit
See all- CVE-2026-42786High
A vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion, enabling unauthorized users to send an unbounded number of continuation frames. The issue occurs in the handle_frame/3 method, which lacks size limits for accumulated data.
- CVE-2026-105660Medium
The bandit library (versions 0.6.0 to 1.13.0) improperly validates syntactic correctness of input. An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target, potentially injecting malicious values into URLs generated by the application.
- CVE-2026-75484Medium
CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.
- CVE-2026-74836High
A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.
- CVE-2026-65623High
Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.
- CVE-2026-39805Medium
A vulnerability in the Bandit library (Elixir) allows HTTP request smuggling via duplicate Content-Length headers. The server accepts the first header and treats the remaining data as a subsequent request on the same connection.
Original NVD description (English source)
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS