Bandit HTTP/2 Connection Window Starvation DoS (CVE-2026-74836)

Vulnerability Overview Vulnerability ID: EEF-CVE-2026-74836 Source: https://cna.ariel.org/osv/EEF-CVE-2026-74836.html JSON Data: https://api.osv.dev/v1/vulns/EEF-CVE-2026-74836 Aliases: - GHSA-x8gq-532w-py94 - CVE-2026-74836 Publication Date: 2026-08-20T21:11:18.999Z Modification Date: 2026-08-20T21:15:04.964872677Z Severity: 9.7 (High) CVSS Score: CVSS:3.4/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/SC:N/MA:N/SA:N Affected Scope Affected Software: Bandit Affected Versions: From 0.3.4 to 1.12.5 Remediation Recommendation: Upgrade to a version that is not affected. Vulnerability Details Vulnerability Type: HTTP/2 connection window starvation causing infinite hang of the ping process Description: - In Bandit, there is an unrestricted resource allocation or throttling vulnerability that allows unauthenticated remote attackers to indefinitely suspend unbound HTTP/2 stream processing via connection-level flow control. - When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams on the connection), queues the remaining bytes and replies with a . The stream process blocks indefinitely on a synchronous call to the connection process. - Nothing unblocks or clears the queue: the client's is sent to the mailbox but never read, as it is stuck in the call and performs no cancellation. Periodic PING frames do not trigger transport-layer timeouts. A similar block in the stream-level send window occurs after approximately 15 seconds; however, there is no equivalent safeguard in the connection-level path. - Each suspended stream hangs its process, plugin state, and any associated resources. Plugins hold onto write buffers, such as upstream connections in reverse proxy scenarios. Attackers can target any endpoint where the response exceeds the connection window (which applies to most non-trivial payloads). By leveraging the stream-level send window limit, the attacker ensures the connection window becomes the bottleneck and keeps the connection alive via periodic PINGs. This primitive can be repeated across streams and connections at the cost of a single idle socket. Database-Specific Information CAPEC IDs: - CAPEC-130 CWE IDs: - CWE-770 CPE IDs: - (Not provided) Summary This vulnerability allows unauthenticated remote attackers to indefinitely suspend stream processes through HTTP/2 connection window starvation, leading to resource exhaustion and service unavailability. It is recommended to upgrade to an unaffected version to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Bandit HTTP/2 Connection Window Starvation DoS (CVE-2026-74836)