Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-108529— SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Quick assessment

Affected

mtrudel bandit

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mtrudel bandit 的 HTTP/2 实现中存在算法复杂度低效漏洞，使得未经认证的远程攻击者能够通过发送微小的 SETTINGS 或连接级 WINDOW_UPDATE 帧耗尽服务器 CPU 资源。攻击者会开启数千个流，使其响应因连接发送窗口阻塞而停滞，随后发送成本极低的帧，迫使服务器对每个帧遍历整个阻塞发送队列。在报告者的测试中，当存在 3000 个阻塞流时，单个 9 字节的 SETTINGS 帧处理耗时达 133 毫秒。在文件中的函数会重试队列中的每个待发送项，且在每次重试前使用从队列中移除该项

CVSS 8.7 · High EPSS 0.60% · P49 Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1499.003 · Application Exhaustion Flood

Affected Version Matrix 2

Vendor	Product	Version Range	Status
mtrudel	bandit	`0.3.4< 1.14.0`	affected
		`6feadb31189d18b7dcda6c663112cd3bbaf63a46< 220b9dfd27f9a21305be2afc75cbe585ddc24e7a`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Source: CVE Program / CVE List V5

Vulnerability Description

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mtrudel	bandit	0.3.4 ~ 1.14.0	`cpe:2.3:a:mtrudel:bandit::::::::`
mtrudel	bandit	6feadb31189d18b7dcda6c663112cd3bbaf63a46 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a	`cpe:2.3:a:mtrudel:bandit::::::::`

II. Public POCs for CVE-2026-108529

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-108529

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108529 (2)

Vendor Advisories for CVE-2026-108529 (2)

🔗 CVE-2026-108529 Read full article related
🔗 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams · Advisory · mtrudel/bandit · GitHub Read full article vendor-advisory related

Other References for CVE-2026-108529 (1)

🔗 EEF-CVE-2026-108529 - OSV related

https://www.cve.org/CVERecord?id=CVE-2026-108529

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213	8.7 HIGH	WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584	8.7 HIGH	HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101	8.7 HIGH	HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436	8.7 HIGH	Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108525	8.7 HIGH	HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269	8.7 HIGH	HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499	8.7 HIGH	Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103	8.2 HIGH	HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-114216	6.3 MEDIUM	Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314	6.3 MEDIUM	WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit

Same vendor: mtrudel

Same weakness: CWE-407