Bandit: Bypass of HTTP/2 per-connection limits via StreamError recovery
Summary
Bandit, an Elixir HTTP server used by Plug and Phoenix applications, does not clean up HTTP/2 connection state correctly after a stream error within one TCP read. An unauthenticated remote attacker can send a single TCP write with several frames so that streams opened before the error keep running while the concurrency and rapid-reset counters forget them. This allows more concurrent requests than the configured max_concurrent_streams limit, which can exhaust CPU, memory and server processes (availability impact only).
Affected
- mtrudel Bandit from 1.9.0 before 1.14.0
- Git range 3ad49c8 up to before 220b9df
Fixed in
- Bandit 1.14.0 (fix commit 220b9df)
Workaround
- Disable HTTP/2 with http_2_options: [enabled: false]. Clients that need HTTP/2 then fall back or fail, so test this first.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public exploit or in-the-wild exploitation known at time of analysis.
Our recommendation
- Find Bandit in mix.lock files across all Elixir projects.
- Upgrade to Bandit 1.14.0 or later and check Hex for newer patch releases.
- If the upgrade is delayed, disable HTTP/2 on internet-facing listeners.
- Monitor the GitHub advisory and CISA KEV for exploitation updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-111103 (CNA EEF) cna.erlef.org
- GitHub Security Advisory GHSA-2238-pgfc-w82m github.com
- OSV record EEF-CVE-2026-111103 osv.dev
- Fix commit 220b9df (version bump to 1.14.0) github.com
- Introducing commit 3ad49c8 github.com
- Bandit package on Hex.pm hex.pm
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:58.
Original description (NVD)
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once. This issue affects bandit: from 1.9.0 before 1.14.0.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-111103.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59
- https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m
- https://osv.dev/vulnerability/EEF-CVE-2026-111103
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.