CVE-2026-105659

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 and later

Description Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small WINDOW UPDATE frames or empty SETTINGS frames, an attacker can reset the 15-second deadline for blocked stream processes. This occurs through two independent paths: one where Bandit.HTTP2.Connection.finish data/5 re-queues partially advanced sends in pending sends with a fresh expires at timestamp, and another where Bandit.HTTP2.Stream.send data/3 recurses on each stream WINDOW UPDATE and re-arms a fresh read timeout. This behavior keeps the blocked stream process, its Plug state, and associated resources alive, potentially exhausting server processes and memory.

Recommendations Disable HTTP/2 by setting http 2 options: [enabled: false]. Terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and communicates with the server using HTTP/1.