CVE-2026-105659: CWE-400 Uncontrolled Resource Consumption in mtrudel bandit

The vulnerability arises because bandit's HTTP/2 stream handling logic resets stream process deadlines whenever partial progress is made via WINDOW_UPDATE or SETTINGS frames. An attacker can exploit this by sending small WINDOW_UPDATE frames intermittently, preventing stream processes from timing out and releasing resources. This leads to uncontrolled resource consumption, as multiple streams and connections can be kept alive indefinitely, exhausting server memory and processes. The vulnerability affects bandit starting from version 1.4.0. There is no information about an available patch or fix in the provided data.

An unauthenticated remote attacker can cause a denial of service by exhausting server resources such as processes and memory. This is achieved by keeping HTTP/2 stream processes alive indefinitely through carefully timed WINDOW_UPDATE frames, leading to resource exhaustion and potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the rate or frequency of WINDOW_UPDATE frames or applying other HTTP/2 stream management controls if possible to mitigate resource exhaustion. Monitor for unusual patterns of small WINDOW_UPDATE frames that may indicate exploitation attempts.