CVE-2026-105659: Bandit HTTP/2 Vulnerability Allows Indefinite Stream Process Pinning
Summary
CVE-2026-105659: Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. Affects bandit across 2 version ranges.
>= 1.4.0
>= fff06efe3be962b484bd4d3eb339372fda5a231f, < d88b21953c65061f21136ea76a89a4f95a2ac7a1
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bandit is an HTTP server built in Elixir, designed to handle HTTP/2 connections efficiently. It allows developers to build scalable web applications with support for modern web standards. However, a vulnerability in Bandit versions 1.4.0 and above can lead to uncontrolled resource consumption, allowing attackers to exploit the HTTP/2 protocol to pin stream processes indefinitely.
Vulnerability Detail
The vulnerability arises from the way Bandit handles WINDOW_UPDATE frames in HTTP/2. When a stream's response exceeds the connection or stream send window, it blocks until more window is granted. Each WINDOW_UPDATE resets the deadline for the blocked stream, allowing an attacker to send small WINDOW_UPDATE frames at intervals to keep the stream alive indefinitely. This can exhaust server resources, leading to denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable HTTP/2 by adding the following configuration to your application:
config :your_app, http_2_options: [enabled: false]
This will remove the vulnerable paths until an update can be applied.
Conclusion
CVE-2026-105659 is a significant vulnerability in the Bandit HTTP server that can lead to severe resource exhaustion if exploited. It is crucial for developers using Bandit to update to the patched version or implement the recommended workarounds to mitigate the risk.
See every vulnerability recorded for bandit →
FAQ
CVE-2026-105659 is a vulnerability in the Bandit HTTP server that allows an attacker to pin HTTP/2 stream processes indefinitely, leading to resource exhaustion.
All versions of Bandit from 1.4.0 onward are affected by this vulnerability.
An attacker can exhaust server processes and memory by keeping blocked stream processes alive indefinitely, potentially leading to denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2026-105659 is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bandit.
