The Bandit HTTP/2 server fails to enforce the negotiated maximum frame size before buffering the frame body, allowing an attacker to send a frame up to 16 MiB in size, resulting in full memory allocation of each requested frame. Because the check occurs only after the payload is stored in memory, a high‑volume, unauthenticated attacker can rapidly deplete server RAM. The vulnerability is a classic example of resource exhaustion, classified as CWE‑770, and can cause a denial‑of‑service on a vulnerable instance.

The Elixir Bandit web server developed by mtrudel, from versions 0.3.6 through 1.10.x, is affected. The issue is present in the core HTTP/2 frame handling module and requires no special configuration. Clients that can establish multiple HTTP/2 connections may trigger the over‑buffering regardless of the server’s negotiated SETTINGS_MAX_FRAME_SIZE value.

The CVSS score of 6.9 reflects the moderate severity of the denial‑of‑service impact. While an exploit is possible without authentication, the required persistence of many concurrent connections reduces the practical exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to initiate remote HTTP/2 requests, send oversized frames, and maintain several parallel connections to overwhelm target memory.