CVE-2026-74836: bandit 0.3.4 to before 1.12.5

Affected technology

bandit · 0.3.4 to before 1.12.5
mtrudel

bandit · 6feadb31189d18b7dcda6c663112cd3bbaf63a46 to before f6914aad14bb1365dd6f306aa592cfb0819bed3e
mtrudel

Component: 'Elixir.Bandit.HTTP2.Connection', 'Elixir.Bandit.HTTP2.Stream'
Function: 'Elixir.Bandit.HTTP2.Connection':finish_data/5, 'Elixir.Bandit.HTTP2.Connection':handle_frame/3, 'Elixir.Bandit.HTTP2.Stream':send_data/3
File: lib/bandit/http2/connection.ex, lib/bandit/http2/stream.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.