# CVE-2026-108529: mtrudel bandit HTTP/2 algorithmic complexity denial of service

Source: https://junglewise.ai/threats/cve-2026-108529-inefficient-algorithmic-complexity-vulnerability-in-the-http-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-108529 · Severity: info · Published 2026-10-26

Bandit is an HTTP/2 web server library written in Elixir. An unauthenticated attacker can send cheap network frames that force the server to perform expensive list operations for every blocked stream, causing CPU exhaustion and denial of service. An attacker exploiting this can make the server unresponsive by sending a single 9-byte frame that takes 133 milliseconds to process on a moderately loaded server.

Technologies: [Mtrudel Bandit](https://junglewise.ai/threats/technologies/mtrudel-bandit). Vendors: [Mtrudel](https://junglewise.ai/threats/vendors/mtrudel).

## Quick answers

**Is CVE-2026-108529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108529 being exploited in the wild.

**How severe is CVE-2026-108529?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** Mtrudel Bandit 0.3.4 to before 1.14.0.

**Is there a fix for CVE-2026-108529?** Yes: fixed in bandit 1.14.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108529 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108529?** Check whether you run Mtrudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in bandit 1.14.0

## Technical details

The HTTP/2 implementation in do_pending_sends/2 uses List.delete/2 to remove queued sends before each retry, resulting in O(n²) complexity for n blocked streams. An attacker can create thousands of streams blocked on the connection send window, then send cheap SETTINGS or WINDOW_UPDATE frames that cause the server to walk the entire queue. The issue exists because max_concurrent_streams defaults to infinity, allowing an attacker to choose the number of blocked streams.

## Affected products

- mtrudel bandit 0.3.4 to before 1.14.0

## Timeline

- 2026-10-26: disclosed: CVE-2026-108529 published

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [mtrudel bandit resource exhaustion in HTTP/2 request body reader](https://junglewise.ai/threats/cve-2026-116078-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit HTTP/2 stream resource exhaustion](https://junglewise.ai/threats/cve-2026-115269-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit WebSocket denial of service via fragmented messages](https://junglewise.ai/threats/cve-2026-114213-allocation-of-resources-without-limits-or-throttling)
- [mtrudel bandit inefficient algorithmic complexity in header parser](https://junglewise.ai/threats/cve-2026-113436-inefficient-algorithmic-complexity-vulnerability-in-the-header)
- [mtrudel bandit HTTP/2 handler resource limit bypass](https://junglewise.ai/threats/cve-2026-111103-improper-cleanup-on-thrown-exception-vulnerability-in-the-http-2)