CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-108525.html
• https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
• https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f
• https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh
• https://osv.dev/vulnerability/EEF-CVE-2026-108525

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108518DBI versions before 1.656 for Perl crash via type confusion …2.9
• CVE-2026-108519Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10852IBM WebSphere Application Server and IBM WebSphere Applicati…7.5
• CVE-2026-108521A vulnerability has been found in Studio-Saelix Sencho up to…4.7
• CVE-2026-108522A vulnerability was found in Studio-Saelix Sencho up to 0.94…8.3
• CVE-2026-108523A vulnerability was determined in Studio-Saelix Sencho up to…4.3
• CVE-2026-108529Inefficient Algorithmic Complexity vulnerability in the HTTP…8.7
• CVE-2026-10853IBM MQ could allow an authenticated attacker with cluster ac…8.8
• CVE-2026-108536IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a …4.6
• CVE-2026-108537Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-108538A security vulnerability has been detected in GPAC up to 26.…6.3
• CVE-2026-108539A vulnerability was detected in GPAC up to 26.07.0. This aff…6.3