Uncontrolled Resource Consumption in Bandit by mtrudel

CVE-2026-105659

What is CVE-2026-105659?

The Bandit library by mtrudel contains an uncontrolled resource consumption vulnerability that allows an unauthenticated remote attacker to disrupt server operations. By sending small WINDOW_UPDATE frames, an attacker can keep HTTP/2 stream processes active indefinitely. This is achieved by manipulating the connection and stream send windows, causing blocked streams to consume server resources excessively. As the attack continues, server processes and memory may become exhausted, leading to potential denial of service. This vulnerability affects Bandit versions starting from 1.4.0.

References