Bandit: Resource exhaustion via HTTP/2 WINDOW_UPDATE and SETTINGS frames
Summary
Bandit, an HTTP server for Elixir and Plug applications, resets the request body read timeout whenever it receives an HTTP/2 WINDOW_UPDATE or empty SETTINGS frame without body data. An unauthenticated remote attacker can send one of these small frames before each timeout expires and keep request handler processes blocked indefinitely. The condition requires HTTP/2 to be enabled and a route that reads request bodies, such as POST, PUT or PATCH handled by Plug.Parsers.
Affected
- Bandit from 1.4.0 before 1.14.0 (Hex package bandit)
- Git range fff06efe3be962b484bd4d3eb339372fda5a231f to before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- Only with HTTP/2 enabled (default: unaffected)
Fixed in
- Bandit 1.14.0 (fix commit 220b9df)
- Note: the related issue EEF-CVE-2026-116078 affects 0.3.1 before 1.14.1, so use at least 1.14.1 and check the current Hex release.
Workaround
- Disable HTTP/2 with http_2_options: [enabled: false] until the update is applied. HTTP/1.1 remains available.
- Whether a reverse proxy in front of Bandit reduces exposure is unknown.
Exploitation
- No public exploit code or in-the-wild exploitation reported at the time of writing.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- The attack requires low effort once known.
Our recommendation
- Check mix.lock files for bandit versions from 1.4.0 up to but excluding 1.14.0.
- Upgrade to the newest Bandit release, at least 1.14.1.
- If an upgrade is not possible immediately, disable HTTP/2 on internet-facing endpoints.
- Check HTTP/2 settings on reverse proxies and load balancers that connect to Bandit backends.
- Monitor for long-lived HTTP/2 streams and rising process or memory use on affected services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CNA record CVE-2026-115269 cna.erlef.org
- GitHub Security Advisory GHSA-p2qv-vx88-385x github.com
- Fix commit 220b9df github.com
- Introducing commit fff06ef github.com
- OSV record EEF-CVE-2026-115269 osv.dev
- OSV record EEF-CVE-2026-116078 (related) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:10.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes. This issue affects bandit: from 1.4.0 before 1.14.0.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-115269.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f
- https://github.com/mtrudel/bandit/security/advisories/GHSA-p2qv-vx88-385x
- https://osv.dev/vulnerability/EEF-CVE-2026-115269
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.