CVE-2026-105659

Deferred Deferred - Pending Action

Uncontrolled Resource Consumption in Bandit

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: EEF

Description

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105659

EUVD

EUVD-2026-101380

Affected Vendors & Products

Vendor	Product	Version / Range
mtrudel	bandit	1.4.0
mtrudel	bandit	fff06efe3be962b484bd4d3eb339372fda5a231f

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is an Uncontrolled Resource Consumption vulnerability in the Bandit HTTP/2 server library. An unauthenticated remote attacker can exploit it by sending a trickle of small WINDOW_UPDATE frames to indefinitely block HTTP/2 stream processes. This causes the server to retain blocked stream processes, their Plug state, and associated resources, leading to potential exhaustion of server processes and memory.

Detection Guidance

Monitor for unusual HTTP/2 traffic patterns, such as repeated small WINDOW_UPDATE frames or streams that remain blocked for extended periods. Check server logs for processes consuming excessive memory or CPU due to prolonged stream handling. Use network monitoring tools like Wireshark to inspect HTTP/2 frames for anomalies in window updates.

Impact Analysis

The vulnerability can lead to denial-of-service by exhausting server resources. Attackers can pin multiple streams open across connections, causing high CPU and memory usage. This may degrade server performance or crash the application entirely.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server resources, which may violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Uncontrolled resource consumption risks disrupting access to personal data, potentially breaching integrity and availability principles.

Mitigation Strategies

Disable HTTP/2 on affected systems or terminate it at a reverse proxy with stricter timeouts. Apply the patch from commit d88b219 to update Bandit to a fixed version. Monitor resource usage and restart processes if resource exhaustion is detected.

Hi! I’m here to help you understand CVE-2026-105659. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70