Bandit EUVD-2026-109819

Exploitation requires (1) HTTP/2 enabled on the Bandit server (the default; the documented workaround is to set http_2_options: [enabled: false]), and (2) at least one route whose handler reads the request body via Plug.Conn.read_body - which Plug.Parsers performs automatically for POST, PUT and PATCH requests, so this is effectively the common case for any app accepting body payloads. No authentication, no user interaction, and no non-default configuration are needed beyond HTTP/2 being on. Limiting factors that reduce realistic exposure: only Bandit versions from 1.4.0 up to (but not including) 1.14.0 are affected; servers with HTTP/2 disabled or whose routes never read request bodies are not exploitable; and impact is confined to availability (stream/process occupancy), with no confidentiality or integrity effect.

This is a genuine availability risk that warrants prompt attention, though not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the description agree and are internally consistent: a network-reachable, unauthenticated attacker with no user interaction can trigger the flaw against low-complexity conditions, and the only impact is availability (VA:H; VC:N/VI:N) - this is a pure resource-exhaustion denial of service (CWE-835/CWE-770), not code execution or data compromise, so the headline 8.7 reflects a high-impact DoS rather than a system-takeover bug. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches the picture of a serious but non-critical issue. No EPSS score was provided, so exploitation probability cannot be quantified. This CVE is NOT on CISA KEV and there is no indication of active exploitation; the GHSA advisory does, however, publish a concrete step-by-step proof-of-concept methodology (open an HTTP/2 POST stream without END_STREAM, send a 1-increment WINDOW_UPDATE every 10s, observe the stream held open for 120s versus ~15s baseline), so the mechanism is fully disclosed and trivially reproducible. The main factor that moderates real-world risk is deployment footprint: Bandit is an Elixir/Erlang HTTP server (common as the Phoenix adapter) rather than ubiquitous infrastructure, so exposure is concentrated in the Elixir ecosystem. No signals conflict here; the chief missing datum is EPSS.

An unauthenticated remote attacker opens an HTTP/2 connection to a Bandit server and sends HEADERS for a POST request without END_STREAM, causing the application's Plug to block in read_body. The attacker then drips a single 9-byte WINDOW_UPDATE (or empty SETTINGS) frame before each read_timeout elapses, resetting the countdown and pinning the stream process - and whatever the request handler holds - open indefinitely, repeated across many streams and connections to exhaust server resources. The GHSA advisory publishes a working PoC methodology demonstrating a stream held open for 120s against a default 15s timeout.