CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115269?
CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit, published on 26 Oct 2026.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body.
Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes.
This issue affects bandit: from 1.4.0 before 1.14.0.
Which versions are affected by CVE-2026-115269?
1 open source package ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 1.4.0 | 1.14.0 |
How do I fix CVE-2026-115269?
Upgrade bandit to 1.14.0 or later.
Is CVE-2026-115269 being exploited?
There is no known exploitation of CVE-2026-115269 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-115269, GHSA-p2qv-vx88-385x, UBUNTU-CVE-2026-115269.