CVE-2026-74836

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.4 through 1.12.4

Description An unauthenticated remote attacker can pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting connection-level flow control. When a stream response body exceeds the HTTP/2 connection-level send window, the Bandit.HTTP2.Connection queues the remaining bytes and a reply closure in pending sends, causing the stream process to block forever during a synchronous call to the connection process. Because there is no bound on this wait and the queue is not purged, client RST STREAM requests are never read, and periodic PING frames prevent transport-level read timeouts from triggering. This allows an attacker to pin processes, Plug state, and associated resources, such as pooled upstream connections in a reverse-proxy Plug, by targeting endpoints with responses larger than the connection window and maintaining the connection with PINGs.

Recommendations Update bandit to version 1.12.5 or later.