CVE-2026-105659 mtrudel CVE debrief

Who should care

Defenders responsible for systems using Bandit, especially those with untrusted or internet-facing HTTP/2 connections, should assess potential exposure and impact. They should prioritize verifying exposure, implementing compensating controls, and monitoring for suspicious activity. Security teams should review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-105659 is an Uncontrolled Resource Consumption vulnerability in Bandit that allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely, potentially leading to resource exhaustion and denial of service.

• Potential resource exhaustion due to prolonged stream process blocking
• Possible denial of service due to increased resource utilization
• Need for verification of Bandit version and exposure
• Potential impact on system availability and performance

Technical summary

The Uncontrolled Resource Consumption vulnerability in Bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. This can lead to resource exhaustion and denial of service. The vulnerability affects systems using Bandit with untrusted or internet-facing HTTP/2 connections. Defenders should prioritize verifying exposure and assessing potential impact. The vulnerability is triggered by the reset of blocked-send deadlines on every WINDOW_UPDATE, allowing a peer to keep the blocked stream process alive for as long as it keeps dripping.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on systems using Bandit, especially those with untrusted or internet-facing HTTP/2 connections.

Recommended defensive actions

• Verify Bandit version and assess exposure
• Implement compensating controls to limit HTTP/2 stream processes
• Monitor for suspicious WINDOW_UPDATE frames
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the Uncontrolled Resource Consumption vulnerability in Bandit, allowing an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. Evidence is limited to CVE Program and NVD records. Defenders should verify Bandit version and exposure, and monitor for suspicious WINDOW_UPDATE frames.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.