# CVE-2026-74836: mtrudel bandit resource exhaustion via HTTP/2 connection window blocking

Source: https://junglewise.ai/threats/cve-2026-74836-mtrudel-bandit-resource-exhaustion-via-http-2-connection-window  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74836 · Severity: info · Published 2026-08-20

Bandit, a web server framework for Elixir applications, contains a resource exhaustion vulnerability in its HTTP/2 implementation. An attacker can send specially crafted HTTP/2 requests that cause server processes to block indefinitely waiting on connection-level flow control, exhausting server resources such as socket connections and connection pools. This allows an attacker to crash or degrade availability of Bandit-based web services without authentication.

## Quick answers

**Is CVE-2026-74836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74836 being exploited in the wild.

**How severe is CVE-2026-74836?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** mtrudel bandit 0.3.4 through 1.12.4.

**Is there a fix for CVE-2026-74836?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-74836 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-74836?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a resource exhaustion vulnerability (CWE-400: Uncontrolled Resource Consumption) in the HTTP/2 connection handling of mtrudel bandit versions 0.3.4 through 1.12.4. The vulnerable component is Bandit.HTTP2.Connection, which queues pending sends when responses exceed the connection-level flow control window (default 65,535 bytes shared across all streams). An attacker exploits this by crafting a response larger than the connection window and then blocking stream-level reads, causing the stream process to block indefinitely in a synchronous write call. Unlike the stream-level window which has a 15-second timeout, the connection-level window has no timeout and no queue bounds. The attacker can send periodic PING frames to keep the connection alive, preventing transport-level read timeouts. The attack is repeatable across multiple streams and connections with minimal client-side resource cost (one idle socket per stalled stream), allowing exhaustion of server resources including pooled upstream connections in reverse-proxy scenarios. The vulnerability is network-reachable and requires no authentication. A fix is available in version 1.12.5 and later.

## Affected products

- mtrudel bandit 0.3.4 through 1.12.4

## Timeline

- 2026-08-20: disclosed