CVE-2026-108529

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.4 through 1.13.x

Description An inefficient algorithmic complexity issue in the HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU resources. By opening thousands of streams that block on the connection send window and subsequently sending small SETTINGS or connection-level WINDOW UPDATE frames, an attacker can force the server to perform quadratic O(n²) list operations. This occurs because the do pending sends/2 function in lib/bandit/http2/connection.ex retries every queued send and removes entries using List.delete/2, causing the server to walk the entire queue of blocked sends for each frame. The impact is amplified because max concurrent streams defaults to :infinity, allowing the attacker to control the number of blocked streams.

Recommendations Update to version 1.14.0 or later. As a temporary workaround for versions 1.9.0 and later, bound the number of streams a client can open by configuring http 2 options: [default local settings: [max concurrent streams: 100]]. As a temporary workaround for versions 0.7.0 and later, disable HTTP/2 by configuring http 2 options: [enabled: false].