{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:04:12.110479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:35:52.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "0.3.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.14.0",
                  "versionStartIncluding": "0.3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Daniel Coles"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Neil Berkman"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mat Trudel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-23T10:13:11.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection.handle_frame/3\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e forwards each DATA frame to the stream process without consulting the receive window, and \u003ccode\u003eBandit.HTTP2.FlowControl.compute_recv_window/2\u003c/code\u003e replenishes the window as data arrives rather than as it is consumed, and never answers a violation with \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.3.1 before 1.14.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\n`Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-125",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
                }
              ],
              "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:29:42.520Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"
        },
        {
          "name": "EEF CNA record for CVE-2026-108525",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-108525",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"
        },
        {
          "name": "Introducing commit c8dc1e9 in mtrudel/bandit",
          "tags": [
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
        },
        {
          "name": "Fix commit 220b9df in mtrudel/bandit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFrom 0.7.0, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e, which removes the vulnerable path.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path."
            }
          ],
          "value": "From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eOn an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e. The server sends one window\u0027s worth and the stream blocks in \u003ccode\u003esend_data/3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\u003c/li\u003e\n\u003cli\u003eBetween batches, at intervals under 15 seconds, send a stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e with an increment of 1 to keep the blocked send alive.\u003c/li\u003e\n\u003cli\u003eSend a PING. It is acknowledged, and the server has sent neither \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e nor \u003ccode\u003eGOAWAY\u003c/code\u003e while its memory grows with every frame.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window\u0027s worth and the stream blocks in `send_data/3`.\n2. Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive.\n4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame."
            }
          ],
          "value": "* On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window\u0027s worth and the stream blocks in send_data/3.\n* Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n* Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.\n* Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Connection-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/flow_control.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003ehandle_frame/3\u003c/code\u003e clause for DATA frames sends the payload to the stream process before any window is checked. It then calls \u003ccode\u003ecompute_recv_window/2\u003c/code\u003e, which subtracts the frame size and, once the window drops below 2^30, advertises a \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Stream-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Accumulation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWhile \u003ccode\u003esend_data/3\u003c/code\u003e waits for send window, its selective \u003ccode\u003ereceive\u003c/code\u003e matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`)\n\nThe `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n**2. Stream-level window** (`lib/bandit/http2/stream.ex`)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n**3. Accumulation**\n\nWhile `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
            }
          ],
          "value": "1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)\n\nThe handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n2. Stream-level window (lib/bandit/http2/stream.ex)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n3. Accumulation\n\nWhile send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-108525",
    "datePublished": "2026-10-26T13:29:42.520Z",
    "dateReserved": "2026-10-15T10:45:02.078Z",
    "dateUpdated": "2026-10-26T15:35:52.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-108525\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-26T15:04:12.110479Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-26T15:33:13.019Z\"}}], \"cna\": {\"title\": \"HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Daniel Coles\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Neil Berkman\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Mat Trudel\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-125\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\", \"base64\": false}]}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.3.1\", \"lessThan\": \"1.14.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/bandit\", \"packageName\": \"bandit\", \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f\", \"lessThan\": \"220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/mtrudel/bandit\", \"packageName\": \"mtrudel/bandit\", \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh\", \"name\": \"HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-108525.html\", \"name\": \"EEF CNA record for CVE-2026-108525\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-108525\", \"name\": \"OSV record EEF-CVE-2026-108525\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f\", \"name\": \"Introducing commit c8dc1e9 in mtrudel/bandit\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"name\": \"Fix commit 220b9df in mtrudel/bandit\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFrom 0.7.0, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e, which removes the vulnerable path.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path.\", \"base64\": false}]}], \"dateAssigned\": \"2026-10-23T10:13:11.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\\n\\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\\n\\nThis issue affects bandit: from 0.3.1 before 1.14.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection.handle_frame/3\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e forwards each DATA frame to the stream process without consulting the receive window, and \u003ccode\u003eBandit.HTTP2.FlowControl.compute_recv_window/2\u003c/code\u003e replenishes the window as data arrives rather than as it is consumed, and never answers a violation with \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e.\u003c/p\u003e\\n\u003cp\u003eThis issue affects bandit: from 0.3.1 before 1.14.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\\n\\n`Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`.\\n\\nThis issue affects bandit: from 0.3.1 before 1.14.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.14.0\", \"versionStartIncluding\": \"0.3.1\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-10-26T13:29:42.520Z\"}, \"x_proofOfConcept\": [{\"lang\": \"en\", \"value\": \"* On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window\u0027s worth and the stream blocks in send_data/3.\\n* Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\\n* Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.\\n* Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003col\u003e\\n\u003cli\u003eOn an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e. The server sends one window\u0027s worth and the stream blocks in \u003ccode\u003esend_data/3\u003c/code\u003e.\u003c/li\u003e\\n\u003cli\u003eSend 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\u003c/li\u003e\\n\u003cli\u003eBetween batches, at intervals under 15 seconds, send a stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e with an increment of 1 to keep the blocked send alive.\u003c/li\u003e\\n\u003cli\u003eSend a PING. It is acknowledged, and the server has sent neither \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e nor \u003ccode\u003eGOAWAY\u003c/code\u003e while its memory grows with every frame.\u003c/li\u003e\\n\u003c/ol\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window\u0027s worth and the stream blocks in `send_data/3`.\\n2. Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\\n3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive.\\n4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame.\", \"base64\": false}]}], \"x_technicalAnalysis\": [{\"lang\": \"en\", \"value\": \"1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)\\n\\nThe handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\\n\\n2. Stream-level window (lib/bandit/http2/stream.ex)\\n\\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\\n\\n3. Accumulation\\n\\nWhile send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cstrong\u003e1. Connection-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/flow_control.ex\u003c/code\u003e)\u003c/p\u003e\\n\u003cp\u003eThe \u003ccode\u003ehandle_frame/3\u003c/code\u003e clause for DATA frames sends the payload to the stream process before any window is checked. It then calls \u003ccode\u003ecompute_recv_window/2\u003c/code\u003e, which subtracts the frame size and, once the window drops below 2^30, advertises a \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e2. Stream-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\\n\u003cp\u003eThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e3. Accumulation\u003c/strong\u003e\u003c/p\u003e\\n\u003cp\u003eWhile \u003ccode\u003esend_data/3\u003c/code\u003e waits for send window, its selective \u003ccode\u003ereceive\u003c/code\u003e matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"**1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`)\\n\\nThe `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\\n\\n**2. Stream-level window** (`lib/bandit/http2/stream.ex`)\\n\\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\\n\\n**3. Accumulation**\\n\\nWhile `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\", \"base64\": false}]}]}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-108525\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-26T15:35:52.227Z\", \"dateReserved\": \"2026-10-15T10:45:02.078Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-10-26T13:29:42.520Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}