Bandit implements HTTP/2 flow control by sharing a single send window across all streams. When a response body exceeds this connection‑level window (default 65,535 bytes) Bandit queues the remaining data in a pending list and the request process blocks inside a synchronous call to the connection in a state that never releases resources. The queue is never purged and a client may send RST_STREAM messages that are ignored while the process remains stuck, keeping the application’s Plug state and any resources it holds (e.g., upstream pooled connections) permanently unavailable. This effectively ties up a process, memory and any downstream connections, leading to resource exhaustion and denial of service.

The vulnerability affects the Bandit web server distributed by mtrudel. Versions from 0.3.4 up to, but not including, 1.12.5 are impacted. Users running any of those releases are susceptible to the described denial‑of‑service scenario.

The CVSS score of 8.7 classifies the flaw as high severity, and the EPSS score is currently unavailable but the lack of an exploitation timeout means an attacker can sustain the attack indefinitely. The flaw is not listed in CISA’s KEV catalog, but the combination of unauthenticated remote reach and a repeatable blocking strategy lowers the practical barrier to exploitation. An attacker would send requests to endpoints with responses larger than the connection window, remain connected with periodic PING frames to avoid read timeouts, and repeatedly open new streams to pin multiple processes.