CVE-2026-108525
Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits or Throttling in Bandit HTTP/2

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-108525
EUVD
EUVD-2026-109818

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.3.1
mtrudel bandit c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108525 is an Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of the Bandit server. It allows an unauthenticated remote attacker to exhaust server memory by sending DATA frames that exceed the advertised receive window. The attacker requests a large response, blocks the stream process, and floods small DATA frames without proper flow control updates. These frames accumulate in the stream's mailbox until the server runs out of memory and crashes.

Detection Guidance

Monitor for HTTP/2 traffic flooding or memory exhaustion on Bandit servers. Check for processes consuming excessive memory or repeated crashes. Use network tools like tcpdump or Wireshark to inspect HTTP/2 DATA frames and flow control violations. Look for streams with unacknowledged WINDOW_UPDATE frames or unusually high DATA frame rates.

Impact Analysis

This vulnerability can cause complete server outages by exhausting memory, affecting all applications running on the server. It requires no authentication or user interaction, making it exploitable remotely. The attack can crash the entire BEAM node, not just the HTTP listener, leading to downtime and potential data loss.

Mitigation Strategies
  • Upgrade Bandit to version 1.14.0 or later to patch the vulnerability.
  • Disable HTTP/2 in Bandit's configuration as a temporary workaround.
  • Implement network-level rate limiting to throttle excessive DATA frame traffic.
  • Monitor server memory usage and restart services if memory exhaustion is detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart