Linux Distros Unpatched Vulnerability : CVE-2026-108525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to...

PT-2026-128251

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do read data/5 in lib/bandit/http2/stream.ex keeps every DA...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

UBUNTU-CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

EUVD-2026-109818

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525

The mtrudel bandit library (versions 0.3.1 before 1.14.0 ) contains an Allocation of Resources Without Limits or Throttling vulnerability in its HTTP/2 implementation. The root cause is that Bandit.HTTP2.Connection.handle_frame/3 forwards DATA frames to the stream process without checking the rec...

EEF-CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

CVE-2026-108525 HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

PT-2026-123293

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

Mat Trudel Bandit resource management error vulnerability

Versions of Mat Trudel Bandit from 0.3.1 up to but not including 1.14.0 contain a resource management vulnerability. This vulnerability arises because the HTTP/2 implementation lacks restrictions or throttling on resource allocation. In Bandit.HTTP2.Connection.handleframe/3, the receive window is...

CVE-2026-80463

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463

Apache bRPC (versions

EUVD-2026-107188

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

PT-2026-120546

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...