Vulnerability-Lookup

CVE-2026-108525 (GCVE-0-2026-108525)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:29 – Updated: 2026-10-26 15:35

Title

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Summary

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 15:04 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 347 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/mtrudel/bandit/security/adviso…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-108525.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-108525	related
https://github.com/mtrudel/bandit/commit/c8dc1e97…	related
https://github.com/mtrudel/bandit/commit/220b9dfd…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
mtrudel	bandit	Affected: 0.3.1 , < 1.14.0 (semver) cpe:2.3:a:mtrudel:bandit::::::::
mtrudel	bandit	Affected: c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f , < 220b9dfd27f9a21305be2afc75cbe585ddc24e7a (git) cpe:2.3:a:mtrudel:bandit::::::::

Credits

Peter Ullrich Daniel Coles Neil Berkman Mat Trudel Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:04:12.110479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:35:52.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "0.3.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.14.0",
                  "versionStartIncluding": "0.3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Daniel Coles"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Neil Berkman"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mat Trudel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-23T10:13:11.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection.handle_frame/3\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e forwards each DATA frame to the stream process without consulting the receive window, and \u003ccode\u003eBandit.HTTP2.FlowControl.compute_recv_window/2\u003c/code\u003e replenishes the window as data arrives rather than as it is consumed, and never answers a violation with \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.3.1 before 1.14.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\n`Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-125",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
                }
              ],
              "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:29:42.520Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"
        },
        {
          "name": "EEF CNA record for CVE-2026-108525",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-108525",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"
        },
        {
          "name": "Introducing commit c8dc1e9 in mtrudel/bandit",
          "tags": [
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
        },
        {
          "name": "Fix commit 220b9df in mtrudel/bandit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFrom 0.7.0, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e, which removes the vulnerable path.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path."
            }
          ],
          "value": "From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eOn an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e. The server sends one window\u0027s worth and the stream blocks in \u003ccode\u003esend_data/3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\u003c/li\u003e\n\u003cli\u003eBetween batches, at intervals under 15 seconds, send a stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e with an increment of 1 to keep the blocked send alive.\u003c/li\u003e\n\u003cli\u003eSend a PING. It is acknowledged, and the server has sent neither \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e nor \u003ccode\u003eGOAWAY\u003c/code\u003e while its memory grows with every frame.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window\u0027s worth and the stream blocks in `send_data/3`.\n2. Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive.\n4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame."
            }
          ],
          "value": "* On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window\u0027s worth and the stream blocks in send_data/3.\n* Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n* Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.\n* Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Connection-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/flow_control.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003ehandle_frame/3\u003c/code\u003e clause for DATA frames sends the payload to the stream process before any window is checked. It then calls \u003ccode\u003ecompute_recv_window/2\u003c/code\u003e, which subtracts the frame size and, once the window drops below 2^30, advertises a \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Stream-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Accumulation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWhile \u003ccode\u003esend_data/3\u003c/code\u003e waits for send window, its selective \u003ccode\u003ereceive\u003c/code\u003e matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`)\n\nThe `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n**2. Stream-level window** (`lib/bandit/http2/stream.ex`)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n**3. Accumulation**\n\nWhile `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
            }
          ],
          "value": "1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)\n\nThe handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n2. Stream-level window (lib/bandit/http2/stream.ex)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n3. Accumulation\n\nWhile send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-108525",
    "datePublished": "2026-10-26T13:29:42.520Z",
    "dateReserved": "2026-10-15T10:45:02.078Z",
    "dateUpdated": "2026-10-26T15:35:52.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-108525",
      "date": "2026-11-04",
      "epss": "0.00602",
      "percentile": "0.48945"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "packageName": "bandit",
                "packageURL": "pkg:hex/bandit",
                "product": "bandit",
                "repo": "https://github.com/mtrudel/bandit",
                "vendor": "mtrudel",
                "versions": [
                  {
                    "lessThan": "1.14.0",
                    "status": "affected",
                    "version": "0.3.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "packageName": "mtrudel/bandit",
                "packageURL": "pkg:github/mtrudel/bandit",
                "product": "bandit",
                "repo": "https://github.com/mtrudel/bandit",
                "vendor": "mtrudel",
                "versions": [
                  {
                    "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
                    "status": "affected",
                    "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
          }
        ],
        "id": "CVE-2026-108525",
        "lastModified": "2026-10-26T16:59:16.113",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-108525",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:04:12.110479Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-26T14:16:24.477",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-108525",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-26T15:04:12.110479Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-26T15:33:13.019Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "packageName": "bandit",
              "packageURL": "pkg:hex/bandit",
              "product": "bandit",
              "repo": "https://github.com/mtrudel/bandit",
              "vendor": "mtrudel",
              "versions": [
                {
                  "lessThan": "1.14.0",
                  "status": "affected",
                  "version": "0.3.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "packageName": "mtrudel/bandit",
              "packageURL": "pkg:github/mtrudel/bandit",
              "product": "bandit",
              "repo": "https://github.com/mtrudel/bandit",
              "vendor": "mtrudel",
              "versions": [
                {
                  "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
                  "status": "affected",
                  "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.14.0",
                      "versionStartIncluding": "0.3.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Daniel Coles"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Neil Berkman"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Mat Trudel"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "dateAssigned": "2026-10-23T10:13:11.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection.handle_frame/3\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e forwards each DATA frame to the stream process without consulting the receive window, and \u003ccode\u003eBandit.HTTP2.FlowControl.compute_recv_window/2\u003c/code\u003e replenishes the window as data arrives rather than as it is consumed, and never answers a violation with \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.3.1 before 1.14.0.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\n`Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
                }
              ],
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-125",
              "descriptions": [
                {
                  "lang": "en",
                  "supportingMedia": [
                    {
                      "base64": false,
                      "type": "text/html",
                      "value": "\u003cp\u003eAn unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener.\u003c/p\u003e"
                    },
                    {
                      "base64": false,
                      "type": "text/markdown",
                      "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
                    }
                  ],
                  "value": "An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node\u0027s memory, so exhausting it takes down every application on the node, not just the HTTP listener."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-26T13:29:42.520Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"
            },
            {
              "name": "EEF CNA record for CVE-2026-108525",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-108525",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"
            },
            {
              "name": "Introducing commit c8dc1e9 in mtrudel/bandit",
              "tags": [
                "related"
              ],
              "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
            },
            {
              "name": "Fix commit 220b9df in mtrudel/bandit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eFrom 0.7.0, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e, which removes the vulnerable path.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path."
                }
              ],
              "value": "From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path."
            }
          ],
          "x_proofOfConcept": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003col\u003e\n\u003cli\u003eOn an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e. The server sends one window\u0027s worth and the stream blocks in \u003ccode\u003esend_data/3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\u003c/li\u003e\n\u003cli\u003eBetween batches, at intervals under 15 seconds, send a stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e with an increment of 1 to keep the blocked send alive.\u003c/li\u003e\n\u003cli\u003eSend a PING. It is acknowledged, and the server has sent neither \u003ccode\u003eFLOW_CONTROL_ERROR\u003c/code\u003e nor \u003ccode\u003eGOAWAY\u003c/code\u003e while its memory grows with every frame.\u003c/li\u003e\n\u003c/ol\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window\u0027s worth and the stream blocks in `send_data/3`.\n2. Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive.\n4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame."
                }
              ],
              "value": "* On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window\u0027s worth and the stream blocks in send_data/3.\n* Send 1-byte DATA frames on that stream in batches, ignoring the server\u0027s receive windows.\n* Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.\n* Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame."
            }
          ],
          "x_technicalAnalysis": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cstrong\u003e1. Connection-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/flow_control.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003ehandle_frame/3\u003c/code\u003e clause for DATA frames sends the payload to the stream process before any window is checked. It then calls \u003ccode\u003ecompute_recv_window/2\u003c/code\u003e, which subtracts the frame size and, once the window drops below 2^30, advertises a \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Stream-level window\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Accumulation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWhile \u003ccode\u003esend_data/3\u003c/code\u003e waits for send window, its selective \u003ccode\u003ereceive\u003c/code\u003e matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream \u003ccode\u003eWINDOW_UPDATE\u003c/code\u003e of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "**1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`)\n\nThe `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n**2. Stream-level window** (`lib/bandit/http2/stream.ex`)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n**3. Accumulation**\n\nWhile `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
                }
              ],
              "value": "1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)\n\nThe handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.\n\n2. Stream-level window (lib/bandit/http2/stream.ex)\n\nThe stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.\n\n3. Accumulation\n\nWhile send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-108525",
        "datePublished": "2026-10-26T13:29:42.520Z",
        "dateReserved": "2026-10-15T10:45:02.078Z",
        "dateUpdated": "2026-10-26T15:35:52.227Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-108525

Vulnerability from fkie_nvd - Published: 2026-10-26 14:16 - Updated: 2026-10-26 16:59

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-108525.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-108525

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "0.3.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory.\n\nBandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.\n\nThis issue affects bandit: from 0.3.1 before 1.14.0."
    }
  ],
  "id": "CVE-2026-108525",
  "lastModified": "2026-10-26T16:59:16.113",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-108525",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-26T15:04:12.110479Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-26T14:16:24.477",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-108525.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-108525"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

UBUNTU-CVE-2026-108525 (CVE-2026-108525)

Vulnerability from osv_ubuntu – Published: 2026-10-26 14:16 – Updated: 2026-10-28 17:50 – Source website

Details

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-108525	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-108525	REPORT
	https://cna.erlef.org/cves/cve-2026-108525.html	REPORT
	https://github.com/mtrudel/bandit/commit/220b9dfd…	REPORT
	https://github.com/mtrudel/bandit/commit/c8dc1e97…	REPORT
	https://github.com/mtrudel/bandit/security/adviso…	REPORT
	https://hex.pm/packages/bandit	REPORT
	https://github.com	REPORT
	https://github.com/mtrudel/bandit	REPORT
	https://repo.hex.pm	REPORT
	https://github.com/cveproject/cvelistv5/tree/main…	REPORT
	https://nvd.nist.gov/vuln/detail/cve-2026-108525	REPORT
	https://osv.dev/vulnerability/eef-cve-2026-108525	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "0.13.2-3"
          },
          {
            "binary_name": "python-bandit",
            "binary_version": "0.13.2-3"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "0.13.2-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@0.13.2-3?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.13.2-1",
        "0.13.2-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.4.0-0ubuntu2"
          },
          {
            "binary_name": "python-bandit",
            "binary_version": "1.4.0-0ubuntu2"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.4.0-0ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.4.0-0ubuntu2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.0-0ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.6.2-1"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.6.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.6.2-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-3",
        "1.6.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.6.2-1"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.6.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.6.2-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.6.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.6.2-3"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.6.2-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.6.2-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.6.2-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.9.4-1"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.9.4-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.9.4-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.10-3",
        "1.9.4-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "bandit",
            "binary_version": "1.7.10-3"
          },
          {
            "binary_name": "python3-bandit",
            "binary_version": "1.7.10-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "bandit",
        "purl": "pkg:deb/ubuntu/bandit@1.7.10-3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.10-2",
        "1.7.10-3"
      ]
    }
  ],
  "aliases": [],
  "details": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream\u0027s mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.",
  "id": "UBUNTU-CVE-2026-108525",
  "modified": "2026-10-28T17:50:32Z",
  "published": "2026-10-26T14:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-108525"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108525"
    },
    {
      "type": "REPORT",
      "url": "https://cna.erlef.org/cves/cve-2026-108525.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mtrudel/bandit/security/advisories/ghsa-c3g7-2pg5-qvwh"
    },
    {
      "type": "REPORT",
      "url": "https://hex.pm/packages/bandit"
    },
    {
      "type": "REPORT",
      "url": "https://github.com"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mtrudel/bandit"
    },
    {
      "type": "REPORT",
      "url": "https://repo.hex.pm"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/cveproject/cvelistv5/tree/main/cves/2026/108xxx/cve-2026-108525.json"
    },
    {
      "type": "REPORT",
      "url": "https://nvd.nist.gov/vuln/detail/cve-2026-108525"
    },
    {
      "type": "REPORT",
      "url": "https://osv.dev/vulnerability/eef-cve-2026-108525"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-108525"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-108525 (GCVE-0-2026-108525)

FKIE_CVE-2026-108525

UBUNTU-CVE-2026-108525 (CVE-2026-108525)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour