Bandit EUVD-2026-109818

Exploitation requires only that the target run Bandit (0.3.1 up to, but not including, 1.14.0) with HTTP/2 enabled, which is the default - so no non-default configuration is needed. The attacker must drive HTTP/2 flow control manually: request a response exceeding the 65,535-byte initial window, withhold WINDOW_UPDATE so the stream stalls in send_data/3 and stops reading, then flood DATA frames while sending periodic 1-byte WINDOW_UPDATEs (under the 15-second send timeout) to keep the stalled send alive. No authentication (PR:N) and no user interaction (UI:N) are required. The only effective limiting factor is HTTP/2 being enabled; the documented workaround that removes the vulnerable path is disabling HTTP/2 via http_2_options: [enabled: false], and the vendor's complete fix is upgrading to 1.14.0.

All reachability signals point to easy exploitation: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, base 8.7 High) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the GHSA advisory confirms the mechanism directly from source (handle_frame/3 forwarding DATA frames without checking the receive window, and compute_recv_window/2 replenishing on arrival rather than consumption). Impact is narrow but severe in one dimension - pure availability (VC:N/VI:N/VA:H): no data is read, modified, or leaked, but because queued frames accumulate in the BEAM node's memory, exhaustion takes down every application co-located on that node, not just the HTTP listener. No EPSS score and no KEV listing are present in the input, so there is no quantitative exploitation-probability signal and no evidence of active exploitation; this is a priority driven by ease-of-trigger and blast radius rather than by observed in-the-wild activity. The vuln.today Decision label is 'this_week', consistent with a serious remotely-triggerable DoS that is not an active-exploitation emergency. A detailed step-by-step reproduction is published in the advisory. Net: a genuine, high-priority DoS for any internet-facing Bandit server with HTTP/2 enabled, tempered only by the fact that it is availability-only with no path to code execution or data compromise; absence of EPSS/KEV data means widespread automated exploitation cannot be confirmed or ruled out from the provided intelligence.

An unauthenticated remote attacker opens an HTTP/2 connection to a Bandit server and requests a resource whose response exceeds the 65,535-byte initial window, then withholds WINDOW_UPDATE so the stream process blocks in send_data/3 and stops reading. The attacker then floods tiny 1-byte DATA frames on that stream, trickling a 1-byte WINDOW_UPDATE under the 15-second send timeout to keep the stream alive, and each unread frame piles up in the stream's mailbox until the BEAM node runs out of memory. A public PoC reference exists in the GHSA advisory describing exactly these steps; it is not verified as working exploit code.