Loading vulnerability…
HTTP/2 Request-Body Timeout Resource Exhaustion in Bandit
CVE-2026-115269 is a resource-exhaustion vulnerability in the HTTP/2 request-body reader of mtrudel Bandit versions 1.4.0 through versions before 1.14.0. Bandit.HTTP2.Stream.do_read_data/4 restarts the full read_timeout after receiving certain control frames, even when no request-body data arrives. A stream WINDOW_UPDATE frame resets the wait, while an empty SETTINGS frame generates a zero-delta window update for every stream and can reset multiple pending reads. An unauthenticated remote attacker can repeatedly send these frames before the timeout expires, indefinitely retaining stream processes and application resources and potentially causing denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can exhaust server resources by keeping request-body reads blocked across many HTTP/2 streams and connections with minimal traffic. Each blocked read retains its stream process and any application resources held by the request handler. The vulnerability has high availability impact; no confidentiality or integrity impact is identified. Its CVSS v4.0 severity score is 8.7.
If you can’t patch tonight, do this now.
Disable HTTP/2 using http_2_options: [enabled: false] until the deployment can be upgraded. The existing transport read timeout and request-body max_bytes limit do not prevent exploitation: incoming control frames maintain transport activity, and only DATA frames decrement the byte limit.
Patch, then assume compromise.
Upgrade Bandit to version 1.14.0 or later, which addresses the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.