CVE-2026-108529

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108529
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108529.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108529
Aliases
Downstream
Published
2026-10-26T13:35:26Z
Modified
2026-10-28T02:54:46Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
Details

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.

do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.

This issue affects bandit: from 0.3.4 before 1.14.0.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108529.json"
}
References

Affected packages

Git / github.com/mtrudel/bandit

Affected ranges

Type
GIT
Repo
https://github.com/mtrudel/bandit
Events
Introduced
6feadb31189d18b7dcda6c663112cd3bbaf63a46
Fixed
220b9dfd27f9a21305be2afc75cbe585ddc24e7a
Introduced
5a9095a093f785391dd8588cda6b5719129f1827
Fixed
220b9dfd27f9a21305be2afc75cbe585ddc24e7a
Fixed
6feadb31189d18b7dcda6c663112cd3bbaf63a46
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "6feadb31189d18b7dcda6c663112cd3bbaf63a46"
                },
                {
                    "fixed": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0.3.4"
                },
                {
                    "fixed": "1.14.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "6feadb31189d18b7dcda6c663112cd3bbaf63a46"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.4.0
0.4.1
0.4.10
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.10
0.5.11
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
1.*
1.0.0
1.0.0-pre.1
1.0.0-pre.10
1.0.0-pre.11
1.0.0-pre.12
1.0.0-pre.13
1.0.0-pre.14
1.0.0-pre.15
1.0.0-pre.16
1.0.0-pre.17
1.0.0-pre.18
1.0.0-pre.2
1.0.0-pre.3
1.0.0-pre.4
1.0.0-pre.5
1.0.0-pre.6
1.0.0-pre.7
1.0.0-pre.8
1.0.0-pre.9
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.11.0
1.11.1
1.12.0
1.12.1
1.12.3
1.12.4
1.12.5
1.13.0
1.13.1
1.2.0
1.2.3
1.3.0
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.6.0
1.6.1
1.6.10
1.6.11
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.8.0
1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108529.json"