CVE-2026-74836

Received Received - Intake

Allocation of Resources Without Limits or Throttling in Bandit

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: EEF

Description

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams on the connection), Bandit.HTTP2.Connection queues the remaining bytes and a reply closure in pending_sends and the stream process blocks forever inside a synchronous call to the connection process. Nothing bounds that wait and nothing purges the queue: a client RST_STREAM for the blocked stream is delivered to its mailbox but never read while it is stuck inside the call, so cancelling frees nothing, and periodic PING frames keep the transport-level read timeout from ever firing. The equivalent block on the stream-level send window is already bounded at 15 seconds; the connection-level path had no such bound. Each stalled stream pins its process, Plug state, and any resource the Plug holds across the blocked write, such as a pooled upstream connection in a reverse-proxy Plug. The attacker chooses any endpoint whose response exceeds the connection window (common for most non-trivial payloads), grants a generous stream-level window so only the connection window limits it, and keeps the connection alive with periodic PINGs; the primitive is repeatable across streams and connections at the cost of one idle socket each. This issue affects bandit: from 0.3.4 before 1.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-74836

Affected Vendors & Products

Vendor	Product	Version / Range
mtrudel	bandit	From 0.3.4 (inc) to 1.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is an Allocation of Resources Without Limits or Throttling issue in the mtrudel bandit software. An unauthenticated remote attacker can exploit it by sending HTTP/2 requests that cause the server to allocate an unbounded number of stream processes indefinitely. The attacker does this by keeping the connection alive with periodic PING frames and ensuring the response body exceeds the default HTTP/2 connection-level send window of 65,535 bytes. This causes the stream process to block forever, pinning resources like pooled upstream connections in a reverse-proxy setup.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by exhausting server resources. Attackers can pin an unlimited number of processes, consuming memory and CPU, which may degrade performance or crash the server. It also risks resource exhaustion in reverse-proxy setups, potentially disrupting legitimate user access to services.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability, which may violate requirements for data accessibility and system reliability. The unbounded resource consumption could lead to service degradation or outages, affecting data processing and storage capabilities.

Mitigation Strategies

Upgrade bandit to version 1.12.5 or later to address the allocation of resources without limits vulnerability in HTTP/2 stream handling.

Hi! I’m here to help you understand CVE-2026-74836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70