CVE-2026-108525— HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 mtrudel 的 Bandit 库中，HTTP/2 实现存在“无限制或无节流地分配资源”的漏洞。该漏洞允许未经身份验证的远程攻击者，通过发送超出服务器已公布接收窗口大小的 DATA 帧，耗尽服务器内存。攻击过程如下：攻击者请求一个大于初始 65,535 字节窗口的响应，并故意不发送 WINDOW_UPDATE 帧。这导致流处理进程在发送数据时阻塞，并停止读取后续数据；随后，攻击者在该流上持续发送大量小型 DATA 帧。由于每个 DATA 帧都被暂存于该流的邮箱（mailbox）中，最终导致 BEAM 节点内

CVSS 8.7 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	0.3.1 ~ 1.14.0	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-108525

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-108525

请登录查看更多情报信息。

Other References for CVE-2026-108525 (5)

https://osv.dev/vulnerability/EEF-CVE-2026-108525 related
https://cna.erlef.org/cves/CVE-2026-108525.html related
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a patch
https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f related
https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-108525

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213	8.7 HIGH	WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584	8.7 HIGH	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101	8.7 HIGH	HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436	8.7 HIGH	Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529	8.7 HIGH	SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-115269	8.7 HIGH	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499	8.7 HIGH	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103	8.2 HIGH	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-114216	6.3 MEDIUM	Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314	6.3 MEDIUM	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-770