internet-facing-service-vulnerabilityopen-source-dependency-vulnerability

Bandit HTTP/2 Timeout Flaw Enables Unauthenticated Resource-Exhaustion Attacks

Vulnerability Disclosure · 3 sources · Updated 12h ago · First seen Oct 26, 2026

A high-severity denial-of-service vulnerability in Bandit's HTTP/2 request-body reader allows unauthenticated remote attackers to keep stream processes and application resources occupied indefinitely. Tracked as CVE-2026-115269, the flaw affects versions 1.4.0 through versions before 1.14.0 and carries a CVSS v4.0 score of 8.7. Attackers can repeatedly send WINDOW_UPDATE or empty SETTINGS frames to reset the request-body read timeout without supplying any body data.

Exposure is limited to HTTP/2-enabled Bandit servers with routes that read request bodies. Bandit 1.14.0 fixes the vulnerability; operators should identify affected deployments and upgrade. Where an immediate upgrade is not possible, disabling HTTP/2 is the documented workaround.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Oct 26, 2026

Oct 26, 20261d ago
CVE-2026-115269 disclosed with HTTP/2 denial-of-service proof of concept
The advisory disclosed the unauthenticated resource-exhaustion vulnerability with a high-severity CVSS v4.0 score of 8.7 and documented disabling HTTP/2 as a workaround. Its proof of concept kept a request-body read open for 120 seconds by sending WINDOW_UPDATE frames every ten seconds, bypassing the default 15-second timeout.
CVE-2026-115269
Reported Oct 26, 20261d ago
Bandit fixes the vulnerability in version 1.14.0
Bandit addressed the HTTP/2 request-body timeout vulnerability in version 1.14.0, with commit 220b9df identified as the fix. Mat Trudel is credited as the remediation developer.
CVE-2026-115269
Reported Oct 26, 20261d ago
Bandit commit introduces HTTP/2 request-body timeout vulnerability
Commit fff06ef introduced a flaw that allows HTTP/2 control frames to restart request-body read timeouts without delivering body data. The vulnerability affects Bandit versions 1.4.0 through versions before 1.14.0.
CVE-2026-115269

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

HTTP/2 Request-Body Timeout Resource Exhaustion in Bandit (CVE-2026-115269)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Oct 26, 2026

CVE-2026-115269 - HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in BanditOpen source ↗

Erlef CnaNews · Oct 26, 2026

CVE-2026-115269Open source ↗

OsvNews · Oct 26, 2026

EEF-CVE-2026-115269 - OSVOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Bandit HTTP/2 Timeout Flaw Enables Unauthenticated Resource-Exhaustion Attacks

How this story unfolded

CVE-2026-115269 disclosed with HTTP/2 denial-of-service proof of concept

Bandit fixes the vulnerability in version 1.14.0

Bandit commit introduces HTTP/2 request-body timeout vulnerability

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Bandit WebSocket flaws allow unauthenticated memory exhaustion

Go net/http Timeout Bypass Enables Denial of Service on Unencrypted HTTP/2 Servers

HTTP/2 Flow-Control Flaw Enables Unauthenticated Server Memory Exhaustion

Bandit HTTP/2 Timeout Flaw Enables Unauthenticated Resource-Exhaustion Attacks

How this story unfolded

CVE-2026-115269 disclosed with HTTP/2 denial-of-service proof of concept

Bandit fixes the vulnerability in version 1.14.0

Bandit commit introduces HTTP/2 request-body timeout vulnerability

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Bandit WebSocket flaws allow unauthenticated memory exhaustion

Go net/http Timeout Bypass Enables Denial of Service on Unencrypted HTTP/2 Servers

HTTP/2 Flow-Control Flaw Enables Unauthenticated Server Memory Exhaustion