The vulnerability arises from the Elixir.Bandit.HTTP2.Frame:deserialize/2 function, which pattern-matches the frame payload before checking the SETTINGS_MAX_FRAME_SIZE limit. This causes the server to allocate memory for the entire frame body regardless of the negotiated maximum frame size during the HTTP/2 handshake. An attacker can exploit this by sending frames with lengths up to the 24-bit maximum (~16 MiB), forcing the server to buffer large amounts of memory. Holding many concurrent connections with such frames can exhaust server memory, leading to denial of service. The flaw affects bandit versions starting at 0.3.6 and prior to 1.11.0.

An unauthenticated attacker can cause memory exhaustion on the affected server by sending oversized HTTP/2 frames, potentially resulting in denial of service. The vulnerability bypasses the negotiated maximum frame size limit, allowing excessive memory allocation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the number of concurrent HTTP/2 connections or implementing external protections such as rate limiting or upstream filtering to mitigate memory exhaustion risks.