CVE-2026-108525

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.1 through 1.13.x

Description An unauthenticated remote attacker can exhaust server memory by sending DATA frames that exceed the advertised receive window in the HTTP/2 implementation. The attacker can request a response larger than the 65,535-byte initial window and withhold WINDOW UPDATE, causing the stream process to block while sending and stop reading. Subsequently, flooding small DATA frames on that stream causes every frame to be queued in the stream's mailbox until the BEAM node runs out of memory. This occurs because Bandit.HTTP2.Connection.handle frame/3 forwards DATA frames to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute recv window/2 replenishes the window as data arrives rather than as it is consumed, failing to trigger a FLOW CONTROL ERROR upon violation.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround for versions 0.7.0 and later, disable HTTP/2 by setting http 2 options: [enabled: false].