Bandit CVE-2026-105659

Requires only that the server accept HTTP/2 connections, which is a default protocol for Bandit; no authentication, user interaction, or non-default server configuration is needed (CVSS PR:N/UI:N/AC:L). The attacker-controlled prerequisites are self-establishing: the peer widens the connection-level window with a large WINDOW_UPDATE on stream 0 and shrinks the per-stream window via a small SETTINGS_INITIAL_WINDOW_SIZE to independently reach the stream-level block, then sustains the attack by sending periodic small WINDOW_UPDATE frames before each 15-second deadline expires. Limiting factors are minimal: it affects only bandit versions from 1.4.0 onward, and the server must be serving a response large enough to outrun the send window; because the two attack paths are independent, closing only the connection-level path does not remove exploitability.

Signals align consistently toward a genuine, easily-triggered availability risk rather than a CVSS-inflated non-issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and high availability impact, which matches the description precisely: a remote peer can pin HTTP/2 stream processes indefinitely with a trickle of WINDOW_UPDATE frames. No EPSS score, KEV listing, or public POC is provided in the input, so there is no public exploit identified at time of analysis and exploitation probability cannot be quantified from the data. The absence of KEV/EPSS does not contradict the CVSS reading - it simply means real-world weaponization is unconfirmed, consistent with a recently disclosed issue that already has a vendor patch. Practical priority is driven by how trivially the condition is reached (dripping a few bytes of window every few seconds, repeated across streams and connections) combined with the fact the two attack paths are independent, so partial mitigation that only closes the connection-level path leaves the stream-level path exploitable. The impact ceiling is availability only - no code execution or data exposure is described.

An unauthenticated remote attacker opens HTTP/2 connections to a Bandit-backed server and requests responses large enough to exhaust the send window, then grants only a few bytes of flow-control window every few seconds via small WINDOW_UPDATE (or SETTINGS) frames, resetting the 15-second deadline on each partial advance. Each blocked stream keeps its process, Plug state, and any held resources alive indefinitely, and repeating this across many streams and connections exhausts server processes and memory. No public exploit is identified in the provided data, but the technique requires only a standard HTTP/2 client and no authentication (PR:N).