Executive brief
Bandit, a web server framework for Elixir applications, contains a resource exhaustion vulnerability in its HTTP/2 implementation. An attacker can send specially crafted HTTP/2 requests that cause server processes to block indefinitely waiting on connection-level flow control, exhausting server resources such as socket connections and connection pools. This allows an attacker to crash or degrade availability of Bandit-based web services without authentication.
Technical details
This is a resource exhaustion vulnerability (CWE-400: Uncontrolled Resource Consumption) in the HTTP/2 connection handling of mtrudel bandit versions 0.3.4 through 1.12.4. The vulnerable component is Bandit.HTTP2.Connection, which queues pending sends when responses exceed the connection-level flow control window (default 65,535 bytes shared across all streams). An attacker exploits this by crafting a response larger than the connection window and then blocking stream-level reads, causing the stream process to block indefinitely in a synchronous write call. Unlike the stream-level window which has a 15-second timeout, the connection-level window has no timeout and no queue bounds. The attacker can send periodic PING frames to keep the connection alive, preventing transport-level read timeouts. The attack is repeatable across multiple streams and connections with minimal client-side resource cost (one idle socket per stalled stream), allowing exhaustion of server resources including pooled upstream connections in reverse-proxy scenarios. The vulnerability is network-reachable and requires no authentication. A fix is available in version 1.12.5 and later.
Affected products
- mtrudel bandit 0.3.4 through 1.12.4
Timeline
- 2026-08-20: disclosed