Is CVE-2026-115269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115269 being exploited in the wild.

How severe is CVE-2026-115269?

Informational severity, published 26 October 2026.

Which products and versions are affected?

Mtrudel Bandit 1.4.0 to 1.13.x.

Is there a fix for CVE-2026-115269?

Yes: fixed in bandit 1.14.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115269 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115269?

Check whether you run Mtrudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115269: mtrudel bandit HTTP/2 stream resource exhaustion

CVE-2026-115269 · Severity: info · Published 2026-10-26

Bandit is an Elixir web server that uses HTTP/2 to serve web applications. An attacker can send specially crafted HTTP/2 frames to keep stream processes open indefinitely, blocking the application from reading request bodies and consuming server resources. This denial-of-service attack requires no authentication and can exhaust a server's capacity to handle legitimate requests.

Technologies: Mtrudel Bandit. Vendors: Mtrudel.

Quick answers

Is CVE-2026-115269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115269 being exploited in the wild.
How severe is CVE-2026-115269?: Informational severity, published 26 October 2026.
Which products and versions are affected?: Mtrudel Bandit 1.4.0 to 1.13.x.
Is there a fix for CVE-2026-115269?: Yes: fixed in bandit 1.14.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115269 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115269?: Check whether you run Mtrudel Bandit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: bandit 1.14.0

Technical details

The HTTP/2 request body reader in bandit (Bandit.HTTP2.Stream.do_read_data/4) resets a read timeout on each iteration, including when stream WINDOW_UPDATE frames or zero-delta SETTINGS frames are received without delivering body data. An unauthenticated remote attacker can send these 9-byte control frames repeatedly to prevent the timeout from firing, holding stream processes and application-level resources indefinitely. This affects bandit versions 1.4.0 through 1.13.x; a fix exists in 1.14.0 and later.

Affected products

mtrudel bandit 1.4.0 to 1.13.x

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.