CVE-2026-115269

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOWUPDATE or empty SETTINGS frames sent while a Plug reads the request body...

CVE-2026-115269

The mtrudel bandit web framework (versions 1.4.0 before 1.14.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling issue in its HTTP/2 request body reader. Specifically, Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex restarts a read_timeout countdown whene...

CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOWUPDATE or empty SETTINGS frames sent while a Plug reads the request body...

EUVD-2026-109819

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOWUPDATE or empty SETTINGS frames sent while a Plug reads the request body...