CVE-2026-111103

Name of the Vulnerable Software and Affected Versions bandit versions 1.9.0 through 1.13.x

Description An improper cleanup process during thrown exceptions in the HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits. When a frame raises a StreamError during the processing of a TCP chunk, the handle data/3 function in Bandit.HTTP2.Handler sends a RST STREAM and reverts the connection state to its condition before the chunk was processed. While streams opened by earlier frames in the chunk continue to execute their Plug calls, the internal bookkeeping—including stream counts, last stream id, rapid-reset timestamps, and the HPACK decoder state—is rolled back. Consequently, the max concurrent streams, max requests, and rapid-reset limiter fail to account for these active streams, allowing a client to exceed the configured concurrency limits and exhaust server CPU and memory resources.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround, disable HTTP/2 by setting http 2 options: [enabled: false] to prevent the vulnerable handler from executing.