CVE-2026-74836: CWE-770 Allocation of Resources Without Limits or Throttling in mtrudel bandit

The vulnerability arises because the HTTP/2 connection-level send window (default 65,535 bytes) is shared across all streams on a connection. When a stream's response body exceeds this window, Bandit.HTTP2.Connection queues the remaining bytes and a reply closure in pending_sends, causing the stream process to block indefinitely inside a synchronous call to the connection process. Unlike the stream-level send window, which has a 15-second bound, the connection-level path has no timeout or purge mechanism. As a result, a client can keep the connection alive with periodic PING frames, preventing transport-level timeouts and causing resource exhaustion by pinning processes and resources such as pooled upstream connections. This affects bandit versions >=0.3.4 and <1.12.5.

An unauthenticated remote attacker can cause denial of service by exhausting server resources indefinitely. Each stalled HTTP/2 stream process consumes memory and other resources, including pooled upstream connections in reverse-proxy scenarios. The attacker can create multiple stalled streams and connections, leading to significant resource exhaustion and potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider limiting the size of responses or implementing external rate limiting on HTTP/2 connections to mitigate resource exhaustion risks.