Live › vulnerability › CVE-2026-108529
Go to dashboardBandit, an Elixir HTTP server, has an HTTP/2 flaw where a few cheap frames make it reprocess a large queue of blocked responses. An unauthenticated remote attacker can open many streams and send small SETTINGS or WINDOW_UPDATE frames to exhaust server CPU.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications running Bandit from 0.3.4 before 1.14.0 that accept HTTP/2 connections from clients, including through Phoenix endpoints. The default of :infinity lets an attacker choose how many streams are queued, so default configurations are exposed. Teams serving only HTTP/1.1 or placing a proxy that terminates HTTP/2 in front of Bandit may be less exposed, but the sources do not confirm this.
max_concurrent_streamsNo product ranges from the sources yet.
mix.lock or mix deps output; affected versions are 0.3.4 up to but not including 1.14.0bandit to 1.14.0 or later with mix deps.update banditEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.
do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.
This issue affects bandit: from 0.3.4 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-108529")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.