{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"bandit","packageURL":"pkg:hex/bandit","product":"bandit","repo":"https://github.com/mtrudel/bandit","vendor":"mtrudel","versions":[{"lessThan":"1.14.0","status":"affected","version":"0.3.4","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"mtrudel/bandit","packageURL":"pkg:github/mtrudel/bandit","product":"bandit","repo":"https://github.com/mtrudel/bandit","vendor":"mtrudel","versions":[{"lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","status":"affected","version":"6feadb31189d18b7dcda6c663112cd3bbaf63a46","versionType":"git"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"0.3.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"reporter","value":"Peter Ullrich"},{"lang":"en","type":"remediation developer","value":"Mat Trudel"},{"lang":"en","type":"analyst","value":"Jonatan Männchen / EEF"}],"dateAssigned":"2026-10-23T10:25:55.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.</p>\n<p><code>do_pending_sends/2</code> in <code>lib/bandit/http2/connection.ex</code> retries every queued send and, before each retry, removes that entry from the queue with <code>List.delete/2</code>, so one frame costs O(n²) list operations for n blocked streams. <code>max_concurrent_streams</code> defaults to <code>:infinity</code>, so the attacker chooses n.</p>\n<p>This issue affects bandit: from 0.3.4 before 1.14.0.</p>"},{"base64":false,"type":"text/markdown","value":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.\n\n`do_pending_sends/2` in `lib/bandit/http2/connection.ex` retries every queued send and, before each retry, removes that entry from the queue with `List.delete/2`, so one frame costs O(n²) list operations for n blocked streams. `max_concurrent_streams` defaults to `:infinity`, so the attacker chooses n.\n\nThis issue affects bandit: from 0.3.4 before 1.14.0."}],"value":"Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process.\n\ndo_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n.\n\nThis issue affects bandit: from 0.3.4 before 1.14.0."}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An unauthenticated remote client that keeps thousands of HTTP/2 response streams blocked makes each 9-byte SETTINGS or stream-0 WINDOW_UPDATE frame cost the server quadratic CPU work. A steady trickle of such frames keeps the connection process, and the scheduler running it, busy for as long as the attacker continues.</p>"},{"base64":false,"type":"text/markdown","value":"An unauthenticated remote client that keeps thousands of HTTP/2 response streams blocked makes each 9-byte SETTINGS or stream-0 WINDOW_UPDATE frame cost the server quadratic CPU work. A steady trickle of such frames keeps the connection process, and the scheduler running it, busy for as long as the attacker continues."}],"value":"An unauthenticated remote client that keeps thousands of HTTP/2 response streams blocked makes each 9-byte SETTINGS or stream-0 WINDOW_UPDATE frame cost the server quadratic CPU work. A steady trickle of such frames keeps the connection process, and the scheduler running it, busy for as long as the attacker continues."}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-26T13:35:26.080Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"name":"SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams","tags":["vendor-advisory","related"],"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-j363-h72p-296m"},{"name":"EEF CNA record for CVE-2026-108529","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-108529.html"},{"name":"OSV record EEF-CVE-2026-108529","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-108529"},{"name":"Introducing commit 6feadb3 in mtrudel/bandit","tags":["related"],"url":"https://github.com/mtrudel/bandit/commit/6feadb31189d18b7dcda6c663112cd3bbaf63a46"},{"name":"Fix commit 220b9df in mtrudel/bandit","tags":["patch"],"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}],"source":{"discovery":"UNKNOWN"},"title":"SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>From 1.9.0, bound the number of streams a client can open, for example with <code>http_2_options: [default_local_settings: [max_concurrent_streams: 100]]</code>, which bounds the work each frame can cause. From 0.7.0, disabling HTTP/2 with <code>http_2_options: [enabled: false]</code> removes the vulnerable path.</p>"},{"base64":false,"type":"text/markdown","value":"From 1.9.0, bound the number of streams a client can open, for example with `http_2_options: [default_local_settings: [max_concurrent_streams: 100]]`, which bounds the work each frame can cause. From 0.7.0, disabling HTTP/2 with `http_2_options: [enabled: false]` removes the vulnerable path."}],"value":"From 1.9.0, bound the number of streams a client can open, for example with http_2_options: [default_local_settings: [max_concurrent_streams: 100]], which bounds the work each frame can cause. From 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the vulnerable path."}],"x_proofOfConcept":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<ol>\n<li>On one HTTP/2 connection, send 3,000 requests to an endpoint with a 20 KB response body, and send no connection-level <code>WINDOW_UPDATE</code>, so the responses queue in <code>pending_sends</code>.</li>\n<li>Send an empty SETTINGS frame followed by a PING.</li>\n<li>Time the PING acknowledgement. In the reporter's run, the single 9-byte SETTINGS frame delayed it by 133 ms. Repeating the frame keeps the connection process busy.</li>\n</ol>"},{"base64":false,"type":"text/markdown","value":"1. On one HTTP/2 connection, send 3,000 requests to an endpoint with a 20 KB response body, and send no connection-level `WINDOW_UPDATE`, so the responses queue in `pending_sends`.\n2. Send an empty SETTINGS frame followed by a PING.\n3. Time the PING acknowledgement. In the reporter's run, the single 9-byte SETTINGS frame delayed it by 133 ms. Repeating the frame keeps the connection process busy."}],"value":"* On one HTTP/2 connection, send 3,000 requests to an endpoint with a 20 KB response body, and send no connection-level WINDOW_UPDATE, so the responses queue in pending_sends.\n* Send an empty SETTINGS frame followed by a PING.\n* Time the PING acknowledgement. In the reporter's run, the single 9-byte SETTINGS frame delayed it by 133 ms. Repeating the frame keeps the connection process busy."}],"x_technicalAnalysis":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p><strong>1. Blocked sends</strong></p>\n<p>A response that outruns the connection send window is queued in <code>pending_sends</code>. With <code>max_concurrent_streams</code> defaulting to <code>:infinity</code> and no connection-level <code>WINDOW_UPDATE</code> from the client, every one of n streams ends up queued.</p>\n<p><strong>2. Trigger</strong> (<code>lib/bandit/http2/connection.ex</code>)</p>\n<p>Every non-ACK SETTINGS frame and every <code>WINDOW_UPDATE</code> on stream 0 calls <code>do_pending_sends/2</code>. SETTINGS handling also sends <code>deliver_send_window_update</code> to every stream even when the window delta is 0, so unread messages pile up in the mailboxes of blocked streams.</p>\n<p><strong>3. Quadratic drain</strong></p>\n<p><code>do_pending_sends/2</code> walks the queue and calls <code>List.delete/2</code> on the whole list before retrying each entry, putting it back at the front if the send is still blocked. One frame therefore costs O(n²) list operations, about 10^8 at n = 10,000.</p>"},{"base64":false,"type":"text/markdown","value":"**1. Blocked sends**\n\nA response that outruns the connection send window is queued in `pending_sends`. With `max_concurrent_streams` defaulting to `:infinity` and no connection-level `WINDOW_UPDATE` from the client, every one of n streams ends up queued.\n\n**2. Trigger** (`lib/bandit/http2/connection.ex`)\n\nEvery non-ACK SETTINGS frame and every `WINDOW_UPDATE` on stream 0 calls `do_pending_sends/2`. SETTINGS handling also sends `deliver_send_window_update` to every stream even when the window delta is 0, so unread messages pile up in the mailboxes of blocked streams.\n\n**3. Quadratic drain**\n\n`do_pending_sends/2` walks the queue and calls `List.delete/2` on the whole list before retrying each entry, putting it back at the front if the send is still blocked. One frame therefore costs O(n²) list operations, about 10^8 at n = 10,000."}],"value":"1. Blocked sends\n\nA response that outruns the connection send window is queued in pending_sends. With max_concurrent_streams defaulting to :infinity and no connection-level WINDOW_UPDATE from the client, every one of n streams ends up queued.\n\n2. Trigger (lib/bandit/http2/connection.ex)\n\nEvery non-ACK SETTINGS frame and every WINDOW_UPDATE on stream 0 calls do_pending_sends/2. SETTINGS handling also sends deliver_send_window_update to every stream even when the window delta is 0, so unread messages pile up in the mailboxes of blocked streams.\n\n3. Quadratic drain\n\ndo_pending_sends/2 walks the queue and calls List.delete/2 on the whole list before retrying each entry, putting it back at the front if the send is still blocked. One frame therefore costs O(n²) list operations, about 10^8 at n = 10,000."}]}},"cveMetadata":{"assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","assignerShortName":"EEF","cveId":"CVE-2026-108529","datePublished":"2026-10-26T13:35:26.080Z","dateReserved":"2026-10-12T16:15:01.628Z","dateUpdated":"2026-10-26T13:35:26.080Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}