CVE-2026-74836: Uncontrolled Resource Allocation in mtrudl/bandit Leading to HTTP/2 Stream DoS

Vulnerability Overview CVE ID: CVE-2026-74836 Publish Date: 2026-08-20 Update Date: 2026-08-20 Vulnerability Description: In the project, a "Resource Allocation Without Limits or Throttling" vulnerability exists. This allows unauthenticated remote attackers to indefinitely pin HTTP/2 stream processes via connection-level flow control. When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams), queues the remaining bytes and delays closure (suspends and sends). Consequently, the stream process becomes permanently blocked on a synchronous call to the connection process. There is no mechanism to wait for or clear the queue; the client's is blocked by stream delivery to its mailbox but is never read, rendering cancellation ineffective. Periodic PING frames maintain transport-layer read timeouts. An equivalent stream-level send window is bounded at 15 seconds, but the connection-level path lacks such boundaries. CVSS Score: 8.7 (HIGH) Affected Versions Affected Versions: - Hex / Bandit: 0.3.4 < 1.12.5 - GitHub / mtrudl/bandit: 6feadb3 < f6914aa Default Status: Not Affected CPE: cpe:2.3:a:mtrudl:bandit:::::::: Remediation Fixed Version: 1.12.5 and above References: - GitHub - mtrudl/bandit - OSV.dev - CVE-2026-74836 Additional Information Credits: - Giovanni Visciano / Hewlett Packard Enterprise - Athonet (Reporter) - Mat Trudel (Remediation developer) - Jonatan Männchen / EEF (Coordinator) CVSS Breakdown CVSS v3.1: 8.7 (HIGH) - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Summary This vulnerability allows an unauthenticated remote attacker to indefinitely pin HTTP/2 stream processes via connection-level flow control, leading to resource exhaustion. The affected versions range from 0.3.4 to 1.12.5. It is recommended to upgrade to version 1.12.5 or later to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-74836: Uncontrolled Resource Allocation in mtrudl/bandit Leading to HTTP/2 Stream DoS