Description
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.

do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.

This issue affects bandit: from 0.3.4 before 1.14.0.
Published: 2026-10-26
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Inefficient algorithmic complexity in Bandit’s HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU by sending small SETTINGS or WINDOW_UPDATE frames. Each frame triggers an O(n²) traversal over a queue of blocked streams, making the server process thousands of queued sends. This results in denial of service, providing the attacker the ability to impair availability of the HTTP/2 service. The weakness is categorized as CWE-407: Uncontrolled Resource Growth.

Affected Systems

Bandit, developed by the mtrudel vendor, is affected from version 0.3.4 up to, but not including, 1.14.0. All releases in that range expose the vulnerable send queue handling path. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score is 8.7, indicating a high severity of denial of service. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known wide‑scale exploitation. The attack can be performed over the network by any client capable of opening an HTTP/2 session, without authentication, and by sending a sequence of stream creations followed by small control frames. Because the server will walk the entire blocked‑stream list for each frame, the damage grows quadratically with the number of streams, making the exploitation both simple to trigger and highly effective in depleting CPU resources.

Generated by OpenCVE AI on October 26, 2026 at 15:22 UTC.

Remediation

Vendor Workaround

From 1.9.0, bound the number of streams a client can open, for example with http_2_options: [default_local_settings: [max_concurrent_streams: 100]], which bounds the work each frame can cause. From 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the vulnerable path.

OpenCVE Recommended Actions

  • Upgrade Bandit to version 1.14.0 or later to receive the fixed HTTP/2 queue handling code.
  • If upgrade is not immediately possible, limit the number of concurrent streams by setting http_2_options: [default_local_settings: [max_concurrent_streams: 100]].
  • As a temporary measure, disable HTTP/2 entirely with http_2_options: [enabled: false] to remove the vulnerable path.
  • Continuously monitor server CPU usage for abnormal spikes that may indicate an ongoing exploitation attempt.

Generated by OpenCVE AI on October 26, 2026 at 15:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0.
Title SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-407
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-26T15:35:50.781Z

Reserved: 2026-10-12T16:15:01.628Z

Link: CVE-2026-108529

cve-icon Vulnrichment

Updated: 2026-10-26T15:32:23.882Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:24.733

Modified: 2026-10-26T16:59:16.113

Link: CVE-2026-108529

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T15:45:12Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity