CVE-2026-115269 PUBLISHED

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.

Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.

This issue affects bandit: from 1.4.0 before 1.14.0.

Disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable read path never runs.

• Peter Ullrich analyst
• Daniel Coles reporter
• Mat Trudel remediation developer
• Jonatan Männchen / EEF analyst

• HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
• EEF CNA record for CVE-2026-115269
• OSV record EEF-CVE-2026-115269
• Introducing commit fff06ef in mtrudel/bandit
• Fix commit 220b9df in mtrudel/bandit

• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') CWE
• CWE-770 Allocation of Resources Without Limits or Throttling CWE

• An unauthenticated client can keep a Bandit HTTP/2 stream, and whatever its request handler holds while reading the body, occupied indefinitely for 9 bytes per read_timeout, and repeat this across many streams and connections. This affects any Bandit server with HTTP/2 enabled whose routes read request bodies, which Plug.Parsers does for POST, PUT and PATCH.