Skip to content
Heist/ feed
High

HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Type: advisorySource: Official CVE List1 source record

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.

Announced Source revision 1
Original source ↗

CVE-2026-105659

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-105659

bandit

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

bandit

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/mtrudel/bandit",
    "vendor": "mtrudel",
    "modules": [
      "'Elixir.Bandit.HTTP2.Connection'",
      "'Elixir.Bandit.HTTP2.Stream'"
    ],
    "product": "bandit",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0",
        "lessThan": "1.13.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/bandit",
    "packageName": "bandit",
    "programFiles": [
      "lib/bandit/http2/connection.ex",
      "lib/bandit/http2/stream.ex"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/mtrudel/bandit",
    "vendor": "mtrudel",
    "modules": [
      "'Elixir.Bandit.HTTP2.Connection'",
      "'Elixir.Bandit.HTTP2.Stream'"
    ],
    "product": "bandit",
    "versions": [
      {
        "status": "affected",
        "version": "fff06efe3be962b484bd4d3eb339372fda5a231f",
        "lessThan": "d88b21953c65061f21136ea76a89a4f95a2ac7a1",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/mtrudel/bandit",
    "packageName": "mtrudel/bandit",
    "programFiles": [
      "lib/bandit/http2/connection.ex",
      "lib/bandit/http2/stream.ex"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"
      },
      {
        "name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"
      }
    ]
  }
]
Related CVEs
CVE-2026-105659

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#34411 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement