CVE-2026-42788 is a medium severity vulnerability in Bandit's HTTP/2 parser where frame size validation occurs only after buffering the entire frame body. This allows an attacker to send frames with sizes much larger than the negotiated maximum, causing the server to buffer excessive data and leading to memory exhaustion denial-of-service. The flaw affects Bandit versions from 0.3.5 up to but not including 1.11.0. No authentication or specific routes are required to exploit this issue. A patch is available in Bandit version 1.11.0 that adds an early frame size check on the 9-byte header to prevent buffering oversized frames.