{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108525", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-15T10:45:02.078Z", "datePublished": "2026-10-26T13:29:42.520Z", "dateUpdated": "2026-10-26T13:29:42.520Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.14.0", "status": "affected", "version": "0.3.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a", "status": "affected", "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.14.0", "versionStartIncluding": "0.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Peter Ullrich"}, {"lang": "en", "type": "reporter", "value": "Daniel Coles"}, {"lang": "en", "type": "reporter", "value": "Neil Berkman"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-10-23T10:13:11.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds <code>WINDOW_UPDATE</code>, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.</p>\n<p><code>Bandit.HTTP2.Connection.handle_frame/3</code> in <code>lib/bandit/http2/connection.ex</code> forwards each DATA frame to the stream process without consulting the receive window, and <code>Bandit.HTTP2.FlowControl.compute_recv_window/2</code> replenishes the window as data arrives rather than as it is consumed, and never answers a violation with <code>FLOW_CONTROL_ERROR</code>.</p>\n<p>This issue affects bandit: from 0.3.1 before 1.14.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.\n\n`Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node's memory, so exhausting it takes down every application on the node, not just the HTTP listener.</p>"}, {"base64": false, "type": "text/markdown", "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node's memory, so exhausting it takes down every application on the node, not just the HTTP listener."}], "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node's memory, so exhausting it takes down every application on the node, not just the HTTP listener."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-26T13:29:42.520Z"}, "references": [{"name": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit", "tags": ["vendor-advisory", "related"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"}, {"name": "EEF CNA record for CVE-2026-108525", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"}, {"name": "OSV record EEF-CVE-2026-108525", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"}, {"name": "Introducing commit c8dc1e9 in mtrudel/bandit", "tags": ["related"], "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"}, {"name": "Fix commit 220b9df in mtrudel/bandit", "tags": ["patch"], "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>From 0.7.0, disable HTTP/2 with <code>http_2_options: [enabled: false]</code>, which removes the vulnerable path.</p>"}, {"base64": false, "type": "text/markdown", "value": "From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path."}], "value": "From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no <code>WINDOW_UPDATE</code>. The server sends one window's worth and the stream blocks in <code>send_data/3</code>.</li>\n<li>Send 1-byte DATA frames on that stream in batches, ignoring the server's receive windows.</li>\n<li>Between batches, at intervals under 15 seconds, send a stream <code>WINDOW_UPDATE</code> with an increment of 1 to keep the blocked send alive.</li>\n<li>Send a PING. It is acknowledged, and the server has sent neither <code>FLOW_CONTROL_ERROR</code> nor <code>GOAWAY</code> while its memory grows with every frame.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window's worth and the stream blocks in `send_data/3`.\n2. Send 1-byte DATA frames on that stream in batches, ignoring the server's receive windows.\n3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive.\n4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame."}], "value": "* On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window's worth and the stream blocks in send_data/3.\n* Send 1-byte DATA frames on that stream in batches, ignoring the server's receive windows.\n* Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.\n* Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Connection-level window</strong> (<code>lib/bandit/http2/connection.ex</code>, <code>lib/bandit/http2/flow_control.ex</code>)</p>\n<p>The <code>handle_frame/3</code> clause for DATA frames sends the payload to the stream process before any window is checked. It then calls <code>compute_recv_window/2</code>, which subtracts the frame size and, once the window drops below 2^30, advertises a <code>WINDOW_UPDATE</code> back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.</p>\n<p><strong>2. Stream-level window</strong> (<code>lib/bandit/http2/stream.ex</code>)</p>\n<p>The stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.</p>\n<p><strong>3. Accumulation</strong></p>\n<p>While <code>send_data/3</code> waits for send window, its selective <code>receive</code> matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream <code>WINDOW_UPDATE</code> of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`)\n\nThe `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n**2. Stream-level window** (`lib/bandit/http2/stream.ex`)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n**3. Accumulation**\n\nWhile `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."}], "value": "1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)\n\nThe handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n2. Stream-level window (lib/bandit/http2/stream.ex)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n3. Accumulation\n\nWhile send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.14.0", "status": "affected", "version": "0.3.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a", "status": "affected", "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."}], "id": "CVE-2026-108525", "lastModified": "2026-10-26T14:16:24.477", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-10-26T14:16:24.477", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{}