ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-105659

HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · HTTP/2 blocked-send deadlines reset

Check if you run it

No confirmed exploitation is on record for CVE-2026-105659. EPSS is 0.53%. Act only if a listed version of HTTP/2 blocked-send deadlines reset is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (HTTP/2 blocked-send deadlines reset).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.53%
Remediation
Advisory link
Affected products
Hex bandit

## Summary Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. re-queues a partially advanced send in with a fresh , so every on stream 0, and every frame, resets the clock. recurses on each stream and re-arms a fresh . A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory. The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large on stream 0 and shrinking the per-stream window with a small , so closing only the connection-level path leaves it exploitable. This issue affects bandit: from 1.4.0 before 1.13.0. ## Details **1. Connection-level block** ( ) A send that outruns the connection send window is queued in with an deadline computed in as now plus (15 seconds). drops any queued send whose deadline has passed whenever data arrives on the connection. runs on every on stream 0 and on every frame (including an empty one, through ). When the granted window is smaller than the queued remainder, the leftover is re-queued through , which recomputes from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty frame restarts it without granting any window at all. **2. Stream-level block** ( ) runs in the stream process. When the stream send window is exhausted it enters a that waits for with (the struct default of 15 seconds, never overridden in ). On each stream it applies the delta and

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex bandit1.4.0 → 1.13.0

How to fix CVE-2026-105659

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-105659. EPSS is 0.53%. Act only if a listed version of HTTP/2 blocked-send deadlines reset is installed.

Which versions are affected?

Compare what you have installed with 1.4.0 → 1.13.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption. EPSS 0.53%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes

  2. Oct 15, 2026 · NIST NVD

    Updated

    Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    bandit fixed in 1.13.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    bandit fixed in 1.13.0

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes par

  6. Oct 15, 2026 · NIST NVD

    Updated

    Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes

Sources

  • CVE.orgVulnerability recordCVE-2026-105659

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-105659

    30-day exploitation probability 0.5%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-69m6-wcv4-rwcf

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-105659

    Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until t

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-105659

    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.