Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.

Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.

This issue affects bandit: from 1.4.0 before 1.14.0.
Published: 2026-10-26
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service via Resource Exhaustion
Action: Patch or Disable
AI Analysis

Impact

The vulnerability, which is an Allocation of Resources Without Limits or Throttling (CWE-770) and an Infinite loop or repetition (CWE-835), exists in Bandit’s HTTP/2 implementation where each incoming frame resets the request body read timeout. An attacker can send repeated WINDOW_UPDATE or zero‑length SETTINGS frames while a request body is being read, causing the timeout to restart indefinitely without delivering any data. This leaves the stream process and any associated application resources blocked persistently, leading to resource exhaustion and a denial‑of‑service condition.

Affected Systems

Affected systems include the Bandit HTTP web server distributed by mtrudel. Versions from 1.4.0 through 1.13.x are affected; version 1.14.0 and later contain the fix.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS information is not available, and the vulnerability is not in the CISA KEV catalog, implying no known exploits yet. The attack vector requires only network access and the ability to send crafted HTTP/2 frames, making exploitation trivial for unauthenticated attackers against any vulnerable Bandit server.

Generated by OpenCVE AI on October 26, 2026 at 17:29 UTC.

Remediation

Vendor Workaround

Disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable read path never runs.

OpenCVE Recommended Actions

  • Upgrade Bandit to version 1.14.0 or later, which removes the reset behavior in the HTTP/2 request body reader.
  • If an upgrade is not yet possible, configure the server to disable HTTP/2 entirely by setting http_2_options:[enabled:false], preventing the vulnerable read path from executing.
  • After applying one of the above measures, monitor server logs for repeated WINDOW_UPDATE or empty SETTINGS frames and verify that the server no longer blocks streams or consumes excessive resources.

Generated by OpenCVE AI on October 26, 2026 at 17:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes. This issue affects bandit: from 1.4.0 before 1.14.0.
Title HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-770
CWE-835
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-26T15:35:52.079Z

Reserved: 2026-10-23T10:15:01.872Z

Link: CVE-2026-115269

cve-icon Vulnrichment

Updated: 2026-10-26T15:33:07.848Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:31.290

Modified: 2026-10-26T16:59:16.113

Link: CVE-2026-115269

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:30:16Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')