Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111103— HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Quick assessment

Affected
mtrudel bandit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 mtrudel 开发的 Bandit 库的 HTTP/2 处理器中存在“抛出异常时清理不当”的漏洞，允许未认证的远程攻击者通过单次 TCP 写操作（该操作携带多个帧，其中至少一个帧会引发流错误）绕过每连接资源限制。 当某个帧在数据块（chunk）处理中途引发 StreamError 时，Bandit.HTTP2.Handler.handle_data/3 会发送 RST_STREAM 并回滚到该数据块之前的连接状态，丢弃剩余数据。由该数据块中较早帧所打开的流仍会继续执行其 Plug 调用，但流计数、last_s

CVSS 8.2 · High EPSS 0.63% · P50

Affected Version Matrix 2

VendorProduct Version RangeStatus
mtrudel bandit 1.9.0< 1.14.0 affected
3ad49c80c268891e7cc412e69649115456638e59< 220b9dfd27f9a21305be2afc75cbe585ddc24e7a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111103

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once. This issue affects bandit: from 1.9.0 before 1.14.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
抛出异常的清理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mtrudel bandit 1.9.0 ~ 1.14.0 cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
mtrudel bandit 3ad49c80c268891e7cc412e69649115456638e59 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-111103

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111103

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111103 (2)

Vendor Advisories for CVE-2026-111103 (2)

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213 8.7 HIGH WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584 8.7 HIGH HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101 8.7 HIGH HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436 8.7 HIGH Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529 8.7 HIGH SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-108525 8.7 HIGH HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269 8.7 HIGH HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499 8.7 HIGH Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-114216 6.3 MEDIUM Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-110314 6.3 MEDIUM WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

IV. Related Vulnerabilities

Same product: bandit
Same vendor: mtrudel
Same weakness: CWE-460