Description
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.

The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.

This issue affects bandit: from 1.4.0 before 1.13.0.
Published: 2026-10-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (resource exhaustion)
Action: Immediate Patch
AI Analysis

Impact

Bandit’s HTTP/2 implementation uses connection and stream contexts that enforce a 15‑second deadline when a stream is blocked waiting for the peer’s WINDOW_UPDATE frames. A flaw in deadline handling allows an unauthenticated remote attacker to keep stream processes alive indefinitely by sending a trickle of small WINDOW_UPDATE frames or SETTINGS frames. Each partial update resets the expiry clock, so the attacker can drain server resources by exhausting processes and memory. The weakness is a classic uncontrolled resource consumption flaw classified as CWE‑400.

Affected Systems

The vulnerability is present in Bandit releases 1.4.0 and later, developed by mtrudel. No other vendors or products are currently affected.

Risk and Exploitability

The CVSS score of 8.7 denotes high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. A remote attacker can exploit the flaw over an open HTTP/2 connection without authentication by issuing small WINDOW_UPDATE frames on stream 0 or SETTINGS frames. By keeping the stream processes blocked, the attacker can force the server to consume memory and process resources indefinitely, eventually causing a denial of service. The flaw operates through the network layer and requires no special privileges.

Generated by OpenCVE AI on October 15, 2026 at 16:06 UTC.

Remediation

Vendor Workaround

Disable HTTP/2 with http_2_options: [enabled: false], which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit.

OpenCVE Recommended Actions

  • Upgrade to a Bandit version that includes the CVE-2026-105659 fix.
  • Disable HTTP/2 by configuring http_2_options.enabled to false in the Bandit configuration.
  • If HTTP/2 remains required, terminate HTTP/2 sessions at a reverse proxy that enforces its own send timeouts and forwards requests to Bandit over HTTP/1.

Generated by OpenCVE AI on October 15, 2026 at 16:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 onward. Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 onward.
Title HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-400
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-16T20:07:01.914Z

Reserved: 2026-10-12T10:00:01.326Z

Link: CVE-2026-105659

cve-icon Vulnrichment

Updated: 2026-10-16T20:06:53.474Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T17:18:15.657

Modified: 2026-10-16T21:17:16.480

Link: CVE-2026-105659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T05:15:02Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption