CVE-2026-108525

## Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds `WINDOW_UPDATE`, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. `Bandit.HTTP2.Connection.handle_frame/3` in `lib/bandit/http2/connection.ex` forwards each DATA frame to the stream process without consulting the receive window, and `Bandit.HTTP2.FlowControl.compute_recv_window/2` replenishes the window as data arrives rather than as it is consumed, and never answers a violation with `FLOW_CONTROL_ERROR`. This issue affects bandit: from 0.3.1 before 1.14.0. ## Details **1. Connection-level window** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/flow_control.ex`) The `handle_frame/3` clause for DATA frames sends the payload to the stream process before any window is checked. It then calls `compute_recv_window/2`, which subtracts the frame size and, once the window drops below 2^30, advertises a `WINDOW_UPDATE` back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed. **2. Stream-level window** (`lib/bandit/http2/stream.ex`) The stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either. **3. Accumulation** While `send_data/3` waits for send window, its selective `receive` matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream `WINDOW_UPDATE` of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames. ## Proof of concept 1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no `WINDOW_UPDATE`. The server sends one window's worth and the stream blocks in `send_data/3`. 2. Send 1-byte DATA frames on that stream in batches, ignoring the server's receive windows. 3. Between batches, at intervals under 15 seconds, send a stream `WINDOW_UPDATE` with an increment of 1 to keep the blocked send alive. 4. Send a PING. It is acknowledged, and the server has sent neither `FLOW_CONTROL_ERROR` nor `GOAWAY` while its memory grows with every frame. ## Impact An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node's memory, so exhausting it takes down every application on the node, not just the HTTP listener. ## Workarounds From 0.7.0, disable HTTP/2 with `http_2_options: [enabled: false]`, which removes the vulnerable path.