CVE-2026-111103

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...

EEF-CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Summary Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises...

CVE-2026-111103

The mtrudel bandit web framework (versions 1.9.0 before 1.14.0 ) contains an Improper Cleanup on Thrown Exception vulnerability in its HTTP/2 handler. When a frame raises a StreamError during chunk processing in Bandit.HTTP2.Handler.handle_data/3, the system sends a RST_STREAM but rolls back conn...

CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...

EUVD-2026-109825

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...