{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111103", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-23T10:30:01.888Z", "datePublished": "2026-10-26T13:32:06.340Z", "dateUpdated": "2026-10-26T13:32:06.340Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.14.0", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a", "status": "affected", "version": "3ad49c80c268891e7cc412e69649115456638e59", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.14.0", "versionStartIncluding": "1.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-10-23T12:27:58.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.</p>\n<p>When a frame raises <code>StreamError</code> partway through a chunk, <code>Bandit.HTTP2.Handler.handle_data/3</code> sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, <code>last_stream_id</code>, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so <code>max_concurrent_streams</code>, <code>max_requests</code> and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than <code>max_concurrent_streams</code> in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.</p>\n<p>This issue affects bandit: from 1.9.0 before 1.14.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises `StreamError` partway through a chunk, `Bandit.HTTP2.Handler.handle_data/3` sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, `last_stream_id`, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so `max_concurrent_streams`, `max_requests` and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than `max_concurrent_streams` in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0."}], "value": "Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured <code>max_concurrent_streams</code> allows (five times the limit in the reporter's test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite <code>max_concurrent_streams</code> are affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "An unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured `max_concurrent_streams` allows (five times the limit in the reporter's test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite `max_concurrent_streams` are affected."}], "value": "An unauthenticated client can run more concurrent Plug calls on one HTTP/2 connection than the configured max_concurrent_streams allows (five times the limit in the reporter's test), tying up the server processes, CPU and memory the limit is meant to cap. Servers that serve HTTP/2 with a finite max_concurrent_streams are affected."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-460", "description": "CWE-460 Improper Cleanup on Thrown Exception", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-26T13:32:06.340Z"}, "references": [{"name": "HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit", "tags": ["vendor-advisory", "related"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m"}, {"name": "EEF CNA record for CVE-2026-111103", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-111103.html"}, {"name": "OSV record EEF-CVE-2026-111103", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-111103"}, {"name": "Introducing commit 3ad49c8 in mtrudel/bandit", "tags": ["related"], "url": "https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59"}, {"name": "Fix commit 220b9df in mtrudel/bandit", "tags": ["patch"], "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Disable HTTP/2 with <code>http_2_options: [enabled: false]</code>, so that the vulnerable HTTP/2 handler never runs.</p>"}, {"base64": false, "type": "text/markdown", "value": "Disable HTTP/2 with `http_2_options: [enabled: false]`, so that the vulnerable HTTP/2 handler never runs."}], "value": "Disable HTTP/2 with http_2_options: [enabled: false], so that the vulnerable HTTP/2 handler never runs."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>Run Bandit with a Plug that blocks until released and with <code>http_2_options: [default_local_settings: [max_concurrent_streams: 10]]</code>.</li>\n<li>Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.</li>\n<li>In one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.</li>\n<li>Send the same write four more times. The Plug runs 50 times concurrently against a limit of 10.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. Run Bandit with a Plug that blocks until released and with `http_2_options: [default_local_settings: [max_concurrent_streams: 10]]`.\n2. Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n3. In one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.\n4. Send the same write four more times. The Plug runs 50 times concurrently against a limit of 10."}], "value": "* Run Bandit with a Plug that blocks until released and with http_2_options: [default_local_settings: [max_concurrent_streams: 10]].\n* Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n* In one TCP write, send 11 HEADERS frames with END_HEADERS and END_STREAM on streams 1, 3, ..., 21, each carrying a header block encoded without indexing. The eleventh is refused with REFUSED_STREAM, and the server forgets the ten streams before it.\n* Send the same write four more times. The Plug runs 50 times concurrently against a limit of 10."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Function-level rescue.</strong> <code>Bandit.HTTP2.Handler.handle_data/3</code> in <code>lib/bandit/http2/handler.ex</code> deserializes every frame in a TCP chunk inside an <code>Enum.reduce_while/3</code> and wraps the whole function in a <code>rescue</code>. Inside that <code>rescue</code>, <code>state</code> is the original function argument, not the <code>reduce_while</code> accumulator.</p>\n<p><strong>2. Rollback on StreamError.</strong> When <code>Bandit.HTTP2.Connection.handle_frame/3</code> raises <code>StreamError</code> partway through the chunk, <code>rescue_stream_error/3</code> sends RST_STREAM and returns <code>{:continue, state}</code> with the connection as it was before the chunk. The rest of the chunk is dropped.</p>\n<p><strong>3. Lost bookkeeping.</strong> Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, <code>last_stream_id</code>, <code>reset_stream_timestamps</code>, <code>recv_hpack_state</code> and <code>buffer</code> are rolled back, so <code>max_concurrent_streams</code>, <code>max_requests</code> and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale <code>last_stream_id</code> in GOAWAY.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Function-level rescue.** `Bandit.HTTP2.Handler.handle_data/3` in `lib/bandit/http2/handler.ex` deserializes every frame in a TCP chunk inside an `Enum.reduce_while/3` and wraps the whole function in a `rescue`. Inside that `rescue`, `state` is the original function argument, not the `reduce_while` accumulator.\n\n**2. Rollback on StreamError.** When `Bandit.HTTP2.Connection.handle_frame/3` raises `StreamError` partway through the chunk, `rescue_stream_error/3` sends RST_STREAM and returns `{:continue, state}` with the connection as it was before the chunk. The rest of the chunk is dropped.\n\n**3. Lost bookkeeping.** Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, `last_stream_id`, `reset_stream_timestamps`, `recv_hpack_state` and `buffer` are rolled back, so `max_concurrent_streams`, `max_requests` and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale `last_stream_id` in GOAWAY."}], "value": "1. Function-level rescue. Bandit.HTTP2.Handler.handle_data/3 in lib/bandit/http2/handler.ex deserializes every frame in a TCP chunk inside an Enum.reduce_while/3 and wraps the whole function in a rescue. Inside that rescue, state is the original function argument, not the reduce_while accumulator.\n\n2. Rollback on StreamError. When Bandit.HTTP2.Connection.handle_frame/3 raises StreamError partway through the chunk, rescue_stream_error/3 sends RST_STREAM and returns {:continue, state} with the connection as it was before the chunk. The rest of the chunk is dropped.\n\n3. Lost bookkeeping. Frames already handled keep their side effects: their stream processes are running the Plug. But the stream counts, last_stream_id, reset_stream_timestamps, recv_hpack_state and buffer are rolled back, so max_concurrent_streams, max_requests and the rapid-reset limiter no longer count those streams. The same rollback drops HPACK table updates, which can mix up headers between requests, misaligns frame parsing, and sends a stale last_stream_id in GOAWAY."}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.14.0", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a", "status": "affected", "version": "3ad49c80c268891e7cc412e69649115456638e59", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error.\n\nWhen a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once.\n\nThis issue affects bandit: from 1.9.0 before 1.14.0."}], "id": "CVE-2026-111103", "lastModified": "2026-10-26T14:16:27.450", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-10-26T14:16:27.450", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-111103.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-111103"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-460"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{}