CVE-2026-74836: Bandit HTTP/2 Connection-Window Starvation Vulnerability
Summary
CVE-2026-74836: HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit. Affects bandit across 2 version ranges.
>= 0.3.4, < 1.12.5
>= 6feadb31189d18b7dcda6c663112cd3bbaf63a46, < f6914aad14bb1365dd6f306aa592cfb0819bed3e
Fixed in 1.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bandit is an open-source web server framework designed for building scalable and efficient applications in the Elixir programming language. It leverages the HTTP/2 protocol to enhance performance through multiplexing and efficient resource management. However, Bandit has a vulnerability that allows an unauthenticated remote attacker to exploit connection-level flow control, leading to resource starvation and potential denial of service.
Vulnerability Detail
The vulnerability arises from an Allocation of Resources Without Limits or Throttling issue in Bandit, specifically affecting versions from 0.3.4 to 1.12.4. An attacker can indefinitely pin an unbounded number of HTTP/2 stream processes by exploiting the connection-level send window, which is set to a default of 65,535 bytes. When a stream's response body exceeds this limit, the excess data is queued, causing the stream process to block indefinitely. This results in resource starvation as the blocked processes hold onto system resources, preventing normal operation and potentially leading to denial of service.
How To Fix
Minimum fixed version
1.12.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the size of response bodies or implementing rate limiting on your endpoints to prevent excessive resource consumption. Additionally, monitor your application for unusual activity that may indicate an attempted exploitation of this vulnerability.
Conclusion
CVE-2026-74836 is a significant vulnerability in the Bandit web server framework that can lead to resource starvation and denial of service. It is crucial for users to update to the latest version to mitigate this risk. Employing workarounds can provide temporary relief while a full update is planned.
See every vulnerability recorded for bandit →
FAQ
CVE-2026-74836 is a vulnerability in the Bandit web server framework that allows an attacker to exploit HTTP/2 connection-level flow control, leading to resource starvation.
Versions of Bandit from 0.3.4 to 1.12.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2026-74836 is 8.7, indicating a high severity level.
If immediate updates are not possible, consider implementing rate limiting and monitoring for unusual activity as temporary workarounds.
Related vulnerabilities
Recent vulnerabilities recorded for bandit.
