CVE-2026-115269 in bandit
Summary
by MITRE • 10/26/2026
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Bandit HTTP/2 server versions prior to 1.14.0 represents a critical resource exhaustion flaw rooted in the improper handling of flow control mechanisms within the HTTP/2 protocol implementation. Specifically, this issue affects the request body reader component, which is responsible for processing incoming data streams from clients. The core technical deficiency lies in how Bandit.HTTP2.Stream.do_read_data manages read timeouts and stream state transitions when interacting with WINDOW_UPDATE frames or empty SETTINGS frames. In a standard HTTP/2 connection, flow control relies on window updates to signal available buffer space; however, the implementation flaw allows an unauthenticated remote attacker to exploit this mechanism to indefinitely stall server-side processes without transmitting any actual payload data.
From a technical perspective, the vulnerability stems from the logic governing the read timeout reset within the stream processing loop. When Bandit waits for incoming frames with a fresh read_timeout, it expects either body data or specific control signals that would naturally conclude the current operation cycle. However, receiving a WINDOW_UPDATE frame, particularly one containing zero delta as part of an empty SETTINGS frame update, triggers a state change that ends the wait condition without delivering any request body content. Instead of terminating the stream processing or moving to a neutral idle state, the system restarts the full read timeout countdown for the next iteration. This creates a predictable loop where the server process remains blocked in a waiting state, effectively holding open the stream and associated application resources indefinitely as long as the attacker continues to send these minimal 9-byte control frames before each timeout expires.
The operational impact of this vulnerability is severe, classifying it under CWE-400: Uncontrolled Resource Consumption. By maintaining an active but non-productive connection, a malicious actor can exhaust server memory and process slots associated with HTTP/2 streams. Since Bandit runs on the Erlang VM using lightweight processes for each stream, while individual process overhead is low, the cumulative effect of thousands or millions of stalled connections can lead to significant performance degradation, increased latency for legitimate users, and potential denial-of-service conditions if system limits are reached. This attack vector requires no authentication, making it particularly dangerous in public-facing deployments where any remote IP address can initiate a connection and begin the resource exhaustion sequence immediately upon establishing an HTTP/2 session.
This flaw aligns with MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion through protocol abuse. The attacker leverages valid protocol frames to manipulate server state in a way that consumes computational resources without providing useful service output. This is distinct from volumetric attacks because it relies on logical exploitation rather than bandwidth saturation, making it harder to detect via simple traffic volume monitoring tools.
Mitigation strategies primarily involve upgrading the Bandit library to version 1.14.0 or later, where this logic has been corrected to properly handle flow control signals without restarting read timeouts in a manner that allows indefinite stalling. For environments unable to upgrade immediately, implementing rate limiting on HTTP/2 connections at the network perimeter can help mitigate the scale of such attacks. Additionally, configuring strict timeout policies for idle streams and monitoring connection states for abnormal durations can provide early detection indicators. Security teams should also ensure that application-level logic does not hold excessive resources during body reading phases, minimizing the blast radius if a single stream is compromised.