CVE-2026-108529

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0.

• CWE-407

• https://cna.erlef.org/cves/CVE-2026-108529.html
• https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
• https://github.com/mtrudel/bandit/commit/6feadb31189d18b7dcda6c663112cd3bbaf63a46
• https://github.com/mtrudel/bandit/security/advisories/GHSA-j363-h72p-296m
• https://osv.dev/vulnerability/EEF-CVE-2026-108529

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108519Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10852IBM WebSphere Application Server and IBM WebSphere Applicati…7.5
• CVE-2026-108521A vulnerability has been found in Studio-Saelix Sencho up to…4.7
• CVE-2026-108522A vulnerability was found in Studio-Saelix Sencho up to 0.94…8.3
• CVE-2026-108523A vulnerability was determined in Studio-Saelix Sencho up to…4.3
• CVE-2026-108525Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-10853IBM MQ could allow an authenticated attacker with cluster ac…8.8
• CVE-2026-108536IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a …4.6
• CVE-2026-108537Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-108538A security vulnerability has been detected in GPAC up to 26.…6.3
• CVE-2026-108539A vulnerability was detected in GPAC up to 26.07.0. This aff…6.3
• CVE-2026-10854A visibility control issue in the event template creation wo…4.3