Is CVE-2026-74836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74836 being exploited in the wild.

How severe is CVE-2026-74836?

Informational severity, published 20 August 2026.

Which products and versions are affected?

mtrudel bandit 0.3.4 through 1.12.4.

Is there a fix for CVE-2026-74836?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-74836 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-74836?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74836: mtrudel bandit resource exhaustion via HTTP/2 connection window blocking

CVE-2026-74836 · Severity: info · Published 2026-08-20

Bandit, a web server framework for Elixir applications, contains a resource exhaustion vulnerability in its HTTP/2 implementation. An attacker can send specially crafted HTTP/2 requests that cause server processes to block indefinitely waiting on connection-level flow control, exhausting server resources such as socket connections and connection pools. This allows an attacker to crash or degrade availability of Bandit-based web services without authentication.

Quick answers

Is CVE-2026-74836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74836 being exploited in the wild.
How severe is CVE-2026-74836?: Informational severity, published 20 August 2026.
Which products and versions are affected?: mtrudel bandit 0.3.4 through 1.12.4.
Is there a fix for CVE-2026-74836?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-74836 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-74836?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a resource exhaustion vulnerability (CWE-400: Uncontrolled Resource Consumption) in the HTTP/2 connection handling of mtrudel bandit versions 0.3.4 through 1.12.4. The vulnerable component is Bandit.HTTP2.Connection, which queues pending sends when responses exceed the connection-level flow control window (default 65,535 bytes shared across all streams). An attacker exploits this by crafting a response larger than the connection window and then blocking stream-level reads, causing the stream process to block indefinitely in a synchronous write call. Unlike the stream-level window which has a 15-second timeout, the connection-level window has no timeout and no queue bounds. The attacker can send periodic PING frames to keep the connection alive, preventing transport-level read timeouts. The attack is repeatable across multiple streams and connections with minimal client-side resource cost (one idle socket per stalled stream), allowing exhaustion of server resources including pooled upstream connections in reverse-proxy scenarios. The vulnerability is network-reachable and requires no authentication. A fix is available in version 1.12.5 and later.

Affected products

mtrudel bandit 0.3.4 through 1.12.4

Timeline

2026-08-20: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.