CVE-2026-108525: Bandit: Resource exhaustion via unbounded HTTP/2 DATA frames

Summary

Bandit, an Elixir HTTP server library, does not enforce HTTP/2 receive windows for inbound DATA frames. An unauthenticated remote attacker can request a large response, withhold WINDOW_UPDATE and flood small DATA frames, which queue in server memory until the BEAM node runs out of memory. This can take down every application on that node. No login or user interaction is required.

Affected

bandit from 0.3.1 before 1.14.0 (Hex package)
Git range c8dc1e9 to before 220b9df

Fixed in

Upgrade to bandit 1.14.0 or later.
A related issue, CVE-2026-116078, also affects 1.14.0. Verify the latest fixed release on hex.pm (1.14.1 or later) before deploying.

Workaround

Disable HTTP/2 on affected listeners with http_2_options: [enabled: false] (available from bandit 0.7.0). This may affect clients or proxies that depend on HTTP/2, so test first.

Exploitation

CISA SSVC: exploitation none, automatable yes, technical impact partial.
No exploitation in the wild known at the time of research. No public exploit code found.

Our recommendation

Identify all Elixir applications using bandit (check mix.lock and deployed releases).
Upgrade to 1.14.0 at minimum, preferably the newest release.
If an upgrade cannot happen soon, disable HTTP/2 on internet-facing listeners.
Monitor BEAM memory usage and alert on sustained growth.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CVE record (CNA EEF) cna.erlef.org
GitHub security advisory GHSA-c3g7-2pg5-qvwh github.com
OSV record EEF-CVE-2026-108525 osv.dev
Fix commit 220b9df github.com
Introducing commit c8dc1e9 github.com
Bandit changelog hexdocs.pm
OSV record EEF-CVE-2026-116078 (related issue) osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:14.

Original description (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed