Resource Limitation Vulnerability in Bandit by mtrudel
CVE-2026-74836

8.7HIGH

Key Information:

Vendor

Mtrudel

Status
Bandit
Vendor
CVE Published:
20 August 2026

What is CVE-2026-74836?

The Bandit by mtrudel faces a serious issue regarding resource allocation without proper limits, which can be exploited by an unauthenticated remote attacker. This vulnerability allows the attacker to indefinitely pin an unbounded number of HTTP/2 stream processes. If the response body of a stream exceeds the connection-level send window, Bandit queues the excess data but fails to handle it properly. As a result, processes are blocked, and resources can be consumed indefinitely, providing an opportunity for attackers to disrupt service and degrade performance.

Affected Version(s)

bandit 0.3.4 < 1.12.5

bandit 6feadb31189d18b7dcda6c663112cd3bbaf63a46

References

https://github.com/mtrudel/bandit/security/advisories/GHS...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-74836.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-74836
related

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Giovanni Visciano / Hewlett Packard Enterprise - Athonet
Mat Trudel
Jonatan Männchen / EEF
.