HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.
CVE-2026-105659
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-105659
bandit
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
bandit
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"modules": [
"'Elixir.Bandit.HTTP2.Connection'",
"'Elixir.Bandit.HTTP2.Stream'"
],
"product": "bandit",
"versions": [
{
"status": "affected",
"version": "1.4.0",
"lessThan": "1.13.0",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/bandit",
"packageName": "bandit",
"programFiles": [
"lib/bandit/http2/connection.ex",
"lib/bandit/http2/stream.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"
},
{
"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"
},
{
"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"
},
{
"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"
}
]
},
{
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"modules": [
"'Elixir.Bandit.HTTP2.Connection'",
"'Elixir.Bandit.HTTP2.Stream'"
],
"product": "bandit",
"versions": [
{
"status": "affected",
"version": "fff06efe3be962b484bd4d3eb339372fda5a231f",
"lessThan": "d88b21953c65061f21136ea76a89a4f95a2ac7a1",
"versionType": "git"
}
],
"packageURL": "pkg:github/mtrudel/bandit",
"packageName": "mtrudel/bandit",
"programFiles": [
"lib/bandit/http2/connection.ex",
"lib/bandit/http2/stream.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"
},
{
"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"
},
{
"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"
},
{
"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"
}
]
}
]- Related CVEs
- CVE-2026-105659
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34411 · Revision 1
- Added to Heist Feed
- Publisher date