{"id":"CVE-2026-108529","kind":"vulnerability","aliases":["CVE-2026-108529"],"related":[],"title":"Bandit: HTTP/2 frames let remote clients exhaust server CPU","description":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.\n\ndo_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.\n\nThis issue affects bandit: from 0.3.4 before 1.14.0.","summary":"Bandit, an Elixir HTTP server, has an HTTP/2 flaw where a few cheap frames make it reprocess a large queue of blocked responses. An unauthenticated remote attacker can open many streams and send small SETTINGS or WINDOW_UPDATE frames to exhaust server CPU.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","http2","package","phoenix","self-hosted"],"not_affected_if":["bandit-1.14-or-later","http1-only"],"how_to_check":"- Check the Bandit version in `mix.lock` or `mix deps` output; affected versions are `0.3.4` up to but not including `1.14.0`\n- Confirm HTTP/2 is served by Bandit (for example via Phoenix endpoints with HTTP/2 enabled)","fix":"- Upgrade `bandit` to `1.14.0` or later with `mix deps.update bandit`","status":"open","published_at":"2026-10-26T14:16:24+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:16+00:00","updated_at":"2026-10-26T14:32:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:32:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `bandit` to `1.14.0` or later with `mix deps.update bandit`","reach":"internet","title":"Bandit: HTTP/2 frames let remote clients exhaust server CPU","impact":"low","summary":"Bandit, an Elixir HTTP server, has an HTTP/2 flaw where a few cheap frames make it reprocess a large queue of blocked responses. An unauthenticated remote attacker can open many streams and send small SETTINGS or WINDOW_UPDATE frames to exhaust server CPU.","category":"package","nicknames":[],"who_cares":["elixir","phoenix","bandit","self-hosted","http2"],"confidence":0.8,"needs_auth":"no","worst_case":"Server CPU is exhausted, causing denial of service for other users","analyst_note":"","how_to_check":"- Check the Bandit version in `mix.lock` or `mix deps` output; affected versions are `0.3.4` up to but not including `1.14.0`\n- Confirm HTTP/2 is served by Bandit (for example via Phoenix endpoints with HTTP/2 enabled)","needs_analyst":false,"not_affected_if":["http1-only","bandit-1.14-or-later"],"who_is_affected":"Applications running Bandit from 0.3.4 before 1.14.0 that accept HTTP/2 connections from clients, including through Phoenix endpoints. The default `max_concurrent_streams` of :infinity lets an attacker choose how many streams are queued, so default configurations are exposed. Teams serving only HTTP/1.1 or placing a proxy that terminates HTTP/2 in front of Bandit may be less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3542,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108529':12A,15A '-2026':11A,14A '/2,':170C '0.3.4':199C '000':134C '1.14.0':201C '133':144C '3':133C '9':139C 'affect':196C 'algorithm':68C 'allow':78C 'attack':50B,82C,98C,191C 'bandit':1A,16B,24B,77C,197C 'block':45B,105C,125C,135C,181C 'byte':140C 'cheap':36B,113C 'choos':192C 'client':6A 'complex':69C 'concurr':184C 'connect':92C,108C 'connection-level':91C 'cost':174C 'cpu':9A,66B,86C 'cve':10A,13A 'default':186C 'elixir':17B,26B 'entri':163C 'everi':154C 'exhaust':7A,64B,84C 'flaw':32B 'frame':3A,37B,62B,96C,114C,142C,173C 'host':23B 'http':27B 'http/2':2A,31B,73C 'http2':18B 'implement':74C 'ineffici':67C 'infin':188C 'issu':195C 'larg':42B 'let':4A 'level':93C 'lib/bandit/http2/connection.ex':152C 'list':177C 'list.delete':169C 'list.delete/2,':168C 'make':38B,117C 'mani':53B 'max':183C 'ms':145C 'mtrudel':76C 'n':176C,180C,193C 'o':175C 'one':172C 'open':52B,99C 'oper':178C 'packag':19B 'pend':149C 'phoenix':20B 'process':147C 'queu':155C 'queue':43B,123C,166C 'remot':5A,49B,81C 'remov':161C 'report':129C 'reprocess':40B 'respons':46B,104C 'retri':153C,160C 'run':131C 'self':22B 'self-host':21B 'send':56B,109C,112C,126C,156C 'sends/2':150C 'server':8A,28B,65B,85C,119C 'set':58B,89C,141C 'singl':138C 'small':57B,88C 'stream':54B,102C,136C,182C,185C 'thousand':100C 'took':143C 'unauthent':48B,80C 'updat':61B,95C 'via':87C 'vulner':70C 'walk':120C 'whole':122C 'whose':103C 'window':60B,94C,110C","nicknames":[],"mitigations":[],"who_affected":"Applications running Bandit from 0.3.4 before 1.14.0 that accept HTTP/2 connections from clients, including through Phoenix endpoints. The default `max_concurrent_streams` of :infinity lets an attacker choose how many streams are queued, so default configurations are exposed. Teams serving only HTTP/1.1 or placing a proxy that terminates HTTP/2 in front of Bandit may be less exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108529","severity":null,"published_at":"2026-10-26T14:16:24+00:00","modified_at":"2026-10-26T14:16:24+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}