Bandit’s HTTP/2 handler fails to correctly cleanup after a thrown exception, allowing a remote attacker to send a single TCP write containing multiple frames including one that raises a stream error. When the stream error is received, Bandit rolls back its connection state, discarding new streams while retaining previous stream counts and limits. As a result, per‑connection limits such as max_concurrent_streams, max_requests, and rapid‑reset throttling are never applied, enabling the attacker to open dozens of logical streams in a single connection and exhaust server resources.

Affected are mtrudel’s Bandit HTTP/2 server in any release from version 1.9.0 through version 1.13.9. The product is widely used in Elixir web services that enable HTTP/2 support.

The CVSS score of 8.2 marks this as a high‑severity flaw. The EPSS score is currently unavailable, and the vulnerability is not yet listed in CISA’s KEV catalogue, but the remote exploitation path is straightforward: an unauthenticated client connecting over HTTP/2 can craft frames to trigger the bug. Because the problem stems from an internal state rollback, the attacker does not need privileged access, and can cause denial of service by bypassing per‑connection limits. The lack of authentication or additional checks makes exploitation highly likely in any system that enables HTTP/2.