CVE-2026-105659: bandit 1.4.0 to before *

Affected technology

bandit · 1.4.0 to before *
mtrudel

bandit · fff06efe3be962b484bd4d3eb339372fda5a231f to before d88b21953c65061f21136ea76a89a4f95a2ac7a1
mtrudel

Component: 'Elixir.Bandit.HTTP2.Connection', 'Elixir.Bandit.HTTP2.Stream'
Function: 'Elixir.Bandit.HTTP2.Connection':finish_data/5, 'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2, 'Elixir.Bandit.HTTP2.Connection':handle_frame/3, 'Elixir.Bandit.HTTP2.Stream':send_data/3
File: lib/bandit/http2/connection.ex, lib/bandit/http2/stream.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.