Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.

Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.

This issue affects bandit: from 0.3.1 before 1.14.0.
Published: 2026-10-26
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch immediately
AI Analysis

Impact

Bandit suffers an allocation of resources error in its HTTP/2 implementation. A client can send DATA frames that exceed the advertised receive window and withhold WINDOW_UPDATE. Because the server forwards each frame to the stream process without checking the window, the server queues frame memory until exhaustion, eventually exhausting the BEAM node’s memory. The outcome is a denial of service. This flaw corresponds to CWE-770.

Affected Systems

The vulnerability affects the Bandit web server developed by mtrudel. Versions from 0.3.1 up to but not including 1.14.0 are vulnerable. Earlier releases and 1.14.0 or later include the fix.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out over an unauthenticated HTTP/2 connection from any remote host. An attacker simply requests a large response, fakes a small frame size, floods the stream, and causes the BEAM node to run out of memory, leading to service disruption.

Generated by OpenCVE AI on October 26, 2026 at 15:25 UTC.

Remediation

Vendor Workaround

From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path.

OpenCVE Recommended Actions

  • Upgrade bandit to version 1.14.0 or later.
  • If an upgrade is not feasible, disable HTTP/2 by setting http_2_options: [enabled: false] in the configuration.
  • Monitor server memory utilization and network traffic for abnormal DATA frame patterns to detect attempted exploitation.

Generated by OpenCVE AI on October 26, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.
Title HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-770
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-26T15:35:52.227Z

Reserved: 2026-10-15T10:45:02.078Z

Link: CVE-2026-108525

cve-icon Vulnrichment

Updated: 2026-10-26T15:33:13.019Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:24.477

Modified: 2026-10-26T16:59:16.113

Link: CVE-2026-108525

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T15:30:15Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling