Allocation of Resources Without Limits or Throttling Affecting bandit package, versions >=1.4.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-HEX-BANDIT-20948248
- published15 Oct 2026
- disclosed14 Oct 2026
- creditThomas Cioppettini
Introduced: 14 Oct 2026
NewCVE-2026-105659 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
bandit is a HTTP server for Plug and WebSock apps.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the finish_data function in lib/bandit/http2/connection.ex and the send_data function in lib/bandit/http2/stream.ex, both of which restart their deadline whenever the peer makes partial progress rather than preserving the original expiry. An attacker can pin stream processes, along with the Plug state and resources they hold, for as long as they keep dripping tiny WINDOW_UPDATE frames, since a partially advanced connection level send is re-queued with an expires_at recomputed from the current time, and the stream level block recurses into send_data and re-arms a fresh read_timeout. The connection level path is reachable by any SETTINGS frame, including an empty one, because its handler also calls do_pending_sends, and the stream level path additionally requires the stream send window to be exhausted while the connection window has room, a state the peer controls, with each of the streams allowed by max_concurrent_streams pinnable on a single connection.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-74836.