IT SBIT Services
Schneeberger
DEEN
CVE tracker

Bandit: Uncontrolled resource consumption via HTTP/2 WINDOW_UPDATE trickle

CVE-2026-105659High 8.7

← All vulnerabilities

Summary

Bandit, an HTTP server for Elixir applications, is affected in its HTTP/2 mode in versions from 1.4.0 before 1.13.0. An unauthenticated remote attacker can keep stream processes and the resources they hold busy indefinitely by sending small WINDOW_UPDATE frames every few seconds, because the send deadline restarts on each partial progress. Repeated across streams and connections, this can exhaust server processes and memory, causing a denial of service.

Affected

  • Bandit from 1.4.0 before 1.13.0 (CVE record)
  • Only listeners with HTTP/2 enabled are exposed
  • Default HTTP/2 configuration is affected

Fixed in

  • Fixed upstream by commits d88b219 and fff06ef
  • Release containing the fix: Bandit 1.13.0 according to the CVE record; some downstream sources cite 1.13.1, not verified against the vendor advisory

Workaround

  • Disable HTTP/2: set http_2_options to enabled: false (removes both vulnerable paths)
  • Or terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and talks HTTP/1 to Bandit

Exploitation

  • CISA SSVC: exploitation status PoC, automatable: yes, technical impact: partial
  • No reports of exploitation in the wild known at the time of writing

Our recommendation

  • Check whether any Bandit-based service accepts HTTP/2 directly
  • Until a fixed release is confirmed and deployed, disable HTTP/2 or place a reverse proxy with send timeouts in front of Bandit
  • Upgrade Bandit to the fixed release after testing, as version 1.13 changes some connection behaviour
  • Monitor process and memory usage of web services for unusual growth

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:00.

Original description (NVD)

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed