Live › vulnerability › CVE-2026-115269
Go to dashboardBandit is an Elixir HTTP server. A remote client can send repeated WINDOW_UPDATE or empty SETTINGS frames while an application reads a request body, resetting the read timeout each time so the stream process stays blocked indefinitely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications running Bandit from 1.4.0 before 1.14.0 that accept HTTP/2 connections and read request bodies through Plug. Exposure depends on whether the HTTP/2 listener is reachable from the internet or other untrusted clients. Deployments on HTTP/1.1 only, or behind a proxy that terminates HTTP/2 and speaks HTTP/1.1 to Bandit, are likely unaffected.
No product ranges from the sources yet.
mix.lock or mix deps output for bandit:bandit listener with HTTP/2 enabled)bandit to 1.14.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115269")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.