{"schema":"threatline.record/2","record":{"id":"CVE-2026-105659","aliases":["GHSA-69m6-wcv4-rwcf"],"summary":"HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit","details":"Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0.","categories":["Unclassified"],"product":"bandit","vendor":"mtrudel","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105659","source_modified_at":"2026-10-16T20:07:01.914Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"bandit","vendor":"mtrudel","versions":[{"lessThan":"1.13.0","status":"affected","version":"1.4.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105659","source_modified_at":"2026-10-16T20:07:01.914Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"bandit","vendor":"mtrudel","versions":[{"lessThan":"d88b21953c65061f21136ea76a89a4f95a2ac7a1","status":"affected","version":"fff06efe3be962b484bd4d3eb339372fda5a231f","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105659","source_modified_at":"2026-10-16T20:07:01.914Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"bandit","ecosystem":null},"version":"1.13.0","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00528,"percentile":0.43918,"score_date":"2026-10-23"},"published_at":"2026-10-14T16:54:46.484Z","modified_at":"2026-10-16T20:07:01.914Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105659","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T20:07:01.914Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105659","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf","tags":["exploit"]},{"source":"CVE List","url":"https://cna.erlef.org/cves/CVE-2026-105659.html","tags":["related"]},{"source":"CVE List","url":"https://osv.dev/vulnerability/EEF-CVE-2026-105659","tags":["related"]},{"source":"CVE List","url":"https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f","tags":["related"]},{"source":"CVE List","url":"https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T20:06:31.239514Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T20:07:01.914Z","content_hash":"04b50afd69b72e674709429f540e302c7c37d31951a3964eb6cd91444cdd502f"}}