CVE-2026-115269highCWE-770CWE-835

CVE-2026-115269: high-severity vulnerability in mtrudel bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Published

Follow this CVE+ Monitor bandit+ Monitor bandit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes. This issue affects bandit: from 1.4.0 before 1.14.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
mtrudel · bandit
Related CVEs — mtrudel bandit

In the same product, most dangerous first.

CVE-2026-39804HIGHWebSocket permessage-deflate inflate has no output-size cap in banditEPSS 0.8%CVE-2026-75484MEDIUMHTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in BanditEPSS 0.7%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2026-74836HIGHHTTP/2 connection-window starvation pins Plug processes indefinitely in BanditEPSS 0.6%CVE-2026-39806HIGHHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditEPSS 0.6%