{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:11:27.499001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:35:51.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "3ad49c80c268891e7cc412e69649115456638e59",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.14.0",
                  "versionStartIncluding": "1.9.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mat Trudel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-23T12:27:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\u003c/p\u003e\n\u003cp\u003eWhen a frame raises \u003ccode\u003eStreamError\u003c/code\u003e partway through a chunk, \u003ccode\u003eBandit.HTTP2.Handler.handle_data/3\u003c/code\u003e sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, \u003ccode\u003elast_stream_id\u003c/code\u003e, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so \u003ccode\u003emax_concurrent_streams\u003c/code\u003e, \u003ccode\u003emax_requests\u003c/code\u003e and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than \u003ccode\u003emax_concurrent_streams\u003c/code\u003e in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 1.9.0 before 1.14.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises `StreamError` partway through a chunk, `Bandit.HTTP2.Handler.handle_data/3` sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, `last_stream_id`, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so `max_concurrent_streams`, `max_requests` and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than `max_concurrent_streams` in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0."
            }
          ],
          "value": "Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured \u003ccode\u003emax_concurrent_streams\u003c/code\u003e allows (five times the limit in the reporter\u0027s test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite \u003ccode\u003emax_concurrent_streams\u003c/code\u003e are affected.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured `max_concurrent_streams` allows (five times the limit in the reporter\u0027s test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite `max_concurrent_streams` are affected."
                }
              ],
              "value": "An unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured max_concurrent_streams allows (five times the limit in the reporter\u0027s test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite max_concurrent_streams are affected."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-460",
              "description": "CWE-460 Improper Cleanup on Thrown Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:32:06.340Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m"
        },
        {
          "name": "EEF CNA record for CVE-2026-111103",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-111103.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-111103",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-111103"
        },
        {
          "name": "Introducing commit 3ad49c8 in mtrudel/bandit",
          "tags": [
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59"
        },
        {
          "name": "Fix commit 220b9df in mtrudel/bandit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e, so that the vulnerable HTTP/2 handler never runs.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Disable HTTP/2 with `http_2_options: [enabled: false]`, so that the vulnerable HTTP/2 handler never runs."
            }
          ],
          "value": "Disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable HTTP/2 handler never runs."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eRun Bandit with a Plug that blocks until released and with \u003ccode\u003ehttp_2_options: [default_local_settings: [max_concurrent_streams: 10]]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\u003c/li\u003e\n\u003cli\u003eIn one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.\u003c/li\u003e\n\u003cli\u003eSend the same write four more times. The Plug runs 50 times concurrently against a limit of 10.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Run Bandit with a Plug that blocks until released and with `http_2_options: [default_local_settings: [max_concurrent_streams: 10]]`.\n2. Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n3. In one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.\n4. Send the same write four more times. The Plug runs 50 times concurrently against a limit of 10."
            }
          ],
          "value": "* Run Bandit with a Plug that blocks until released and with http_2_options: [default_local_settings: [max_concurrent_streams: 10]].\n* Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n* In one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.\n* Send the same write four more times. The Plug runs 50 times concurrently against a limit of 10."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Function-level rescue.\u003c/strong\u003e \u003ccode\u003eBandit.HTTP2.Handler.handle_data/3\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/handler.ex\u003c/code\u003e deserializes every frame in a TCP chunk inside an \u003ccode\u003eEnum.reduce_while/3\u003c/code\u003e and wraps the whole function in a \u003ccode\u003erescue\u003c/code\u003e. Inside that \u003ccode\u003erescue\u003c/code\u003e, \u003ccode\u003estate\u003c/code\u003e is the original function argument, not the \u003ccode\u003ereduce_while\u003c/code\u003e accumulator.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Rollback on StreamError.\u003c/strong\u003e When \u003ccode\u003eBandit.HTTP2.Connection.handle_frame/3\u003c/code\u003e raises \u003ccode\u003eStreamError\u003c/code\u003e partway through the chunk, \u003ccode\u003erescue_stream_error/3\u003c/code\u003e sends RST_STREAM and returns \u003ccode\u003e{:continue, state}\u003c/code\u003e with the connection as it was before the chunk. The rest of the chunk is dropped.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Lost bookkeeping.\u003c/strong\u003e Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, \u003ccode\u003elast_stream_id\u003c/code\u003e, \u003ccode\u003ereset_stream_timestamps\u003c/code\u003e, \u003ccode\u003erecv_hpack_state\u003c/code\u003e and \u003ccode\u003ebuffer\u003c/code\u003e are rolled back, so \u003ccode\u003emax_concurrent_streams\u003c/code\u003e, \u003ccode\u003emax_requests\u003c/code\u003e and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale \u003ccode\u003elast_stream_id\u003c/code\u003e in GOAWAY.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Function-level rescue.** `Bandit.HTTP2.Handler.handle_data/3` in `lib/bandit/http2/handler.ex` deserializes every frame in a TCP chunk inside an `Enum.reduce_while/3` and wraps the whole function in a `rescue`. Inside that `rescue`, `state` is the original function argument, not the `reduce_while` accumulator.\n\n**2. Rollback on StreamError.** When `Bandit.HTTP2.Connection.handle_frame/3` raises `StreamError` partway through the chunk, `rescue_stream_error/3` sends RST_STREAM and returns `{:continue, state}` with the connection as it was before the chunk. The rest of the chunk is dropped.\n\n**3. Lost bookkeeping.** Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, `last_stream_id`, `reset_stream_timestamps`, `recv_hpack_state` and `buffer` are rolled back, so `max_concurrent_streams`, `max_requests` and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale `last_stream_id` in GOAWAY."
            }
          ],
          "value": "1. Function-level rescue. Bandit.HTTP2.Handler.handle_data/3 in lib/bandit/http2/handler.ex deserializes every frame in a TCP chunk inside an Enum.reduce_while/3 and wraps the whole function in a rescue. Inside that rescue, state is the original function argument, not the reduce_while accumulator.\n\n2. Rollback on StreamError. When Bandit.HTTP2.Connection.handle_frame/3 raises StreamError partway through the chunk, rescue_stream_error/3 sends RST_STREAM and returns {:continue, state} with the connection as it was before the chunk. The rest of the chunk is dropped.\n\n3. Lost bookkeeping. Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, last_stream_id, reset_stream_timestamps, recv_hpack_state and buffer are rolled back, so max_concurrent_streams, max_requests and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale last_stream_id in GOAWAY."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-111103",
    "datePublished": "2026-10-26T13:32:06.340Z",
    "dateReserved": "2026-10-23T10:30:01.888Z",
    "dateUpdated": "2026-10-26T15:35:51.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}