mtrudel Bandit EUVD-2026-109829

Requires only that the target run Bandit (versions in the affected range, below 1.14.0) with HTTP/2 enabled - the default handling of non-ACK SETTINGS and connection-level WINDOW_UPDATE frames is vulnerable, and max_concurrent_streams defaults to :infinity, so no non-default configuration is needed. The attacker must be able to establish HTTP/2 connections and must keep many response streams blocked on the connection send window (by issuing many requests with sizeable responses and withholding connection WINDOW_UPDATE frames); the quadratic cost scales with the number of blocked streams the attacker chooses. Limiting factors are minimal: exploitation is remote and unauthenticated (PR:N), needs no user interaction (UI:N), and works against default configurations; the only real prerequisite is that HTTP/2 is served and the server accepts enough concurrent streams, which is the default.

This is a genuine, well-substantiated availability risk rather than an inflated high-CVSS paper tiger. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and no special attack requirement, and the impact is scoped purely to availability (VA:H; VC:N/VI:N) - consistent with the CWE-407 algorithmic-complexity DoS described: do_pending_sends/2 performs O(n²) List.delete/2 work per cheap SETTINGS or stream-0 WINDOW_UPDATE frame, and max_concurrent_streams defaults to :infinity so the attacker controls n. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits a serious DoS that is not yet weaponized at scale. No EPSS score and no KEV listing were provided, so there is no evidence of active in-the-wild exploitation; however a complete, reporter-verified proof-of-concept is published in the GHSA advisory (133 ms to process one 9-byte frame at 3,000 blocked streams), which materially raises practical risk. The signals are consistent with each other: high severity for availability, easy to trigger, patch available, exploit code public, but no confirmed active exploitation - prioritize patching promptly (this_week) without treating it as an active-attack emergency. One data note: NVD-style affected range is stated as 'from 0.3.4', while the GHSA advisory text states 'from 0.3.6 onward' - verify the exact lower bound against the vendor advisory.

An unauthenticated attacker opens a single HTTP/2 connection to a Bandit server, issues thousands of requests whose large responses block on the connection-level send window (never sending a connection WINDOW_UPDATE so every response stays queued in pending_sends), then repeatedly sends tiny 9-byte empty SETTINGS (or stream-0 WINDOW_UPDATE) frames. Each cheap frame forces quadratic list traversal over the blocked streams, pinning BEAM schedulers and starving all other requests on the node. A public, reporter-verified PoC exists demonstrating 133 ms of processing for a single frame at 3,000 blocked streams, and the low complexity (AC:L, PR:N, UI:N) makes this trivially repeatable from a few low-bandwidth connections.