CVE-2026-105659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105659", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-12T10:00:01.326Z", "datePublished": "2026-10-14T16:54:46.484Z", "dateUpdated": "2026-10-16T20:07:01.914Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.13.0", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "d88b21953c65061f21136ea76a89a4f95a2ac7a1", "status": "affected", "version": "fff06efe3be962b484bd4d3eb339372fda5a231f", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.13.0", "versionStartIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Thomas Cioppettini"}, {"lang": "en", "type": "reporter", "value": "Thomas Cioppettini"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}], "dateAssigned": "2026-10-12T16:13:25.000Z", "datePublic": "2026-10-14T16:54:46.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small <code>WINDOW_UPDATE</code> frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. <code>Bandit.HTTP2.Connection.finish_data/5</code> re-queues a partially advanced send in <code>pending_sends</code> with a fresh <code>expires_at</code>, so every <code>WINDOW_UPDATE</code> on stream 0, and every <code>SETTINGS</code> frame, resets the clock. <code>Bandit.HTTP2.Stream.send_data/3</code> recurses on each stream <code>WINDOW_UPDATE</code> and re-arms a fresh <code>after read_timeout</code>. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.</p>\n<p>The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large <code>WINDOW_UPDATE</code> on stream 0 and shrinking the per-stream window with a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code>, so closing only the connection-level path leaves it exploitable.</p>\n<p>This issue affects bandit: from 1.4.0 before 1.13.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small `WINDOW_UPDATE` frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. `Bandit.HTTP2.Connection.finish_data/5` re-queues a partially advanced send in `pending_sends` with a fresh `expires_at`, so every `WINDOW_UPDATE` on stream 0, and every `SETTINGS` frame, resets the clock. `Bandit.HTTP2.Stream.send_data/3` recurses on each stream `WINDOW_UPDATE` and re-arms a fresh `after read_timeout`. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large `WINDOW_UPDATE` on stream 0 and shrinking the per-stream window with a small `SETTINGS_INITIAL_WINDOW_SIZE`, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0."}], "value": "Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0."}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A remote, unauthenticated peer requests a response larger than a send window, then drips tiny <code>WINDOW_UPDATE</code> frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory.</p>"}, {"base64": false, "type": "text/markdown", "value": "A remote, unauthenticated peer requests a response larger than a send window, then drips tiny `WINDOW_UPDATE` frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory."}], "value": "A remote, unauthenticated peer requests a response larger than a send window, then drips tiny WINDOW_UPDATE frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-15T18:37:59.434Z"}, "references": [{"name": "GitHub Advisory", "tags": ["related", "vendor-advisory"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf"}, {"name": "EEF CNA record for CVE-2026-105659", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-105659.html"}, {"name": "OSV record EEF-CVE-2026-105659", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105659"}, {"name": "Introducing commit fff06ef in mtrudel/bandit", "tags": ["related"], "url": "https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f"}, {"name": "Fix commit d88b219 in mtrudel/bandit", "tags": ["patch"], "url": "https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1"}], "source": {"discovery": "EXTERNAL"}, "title": "HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Disable HTTP/2 with <code>http_2_options: [enabled: false]</code>, which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit.</p>"}, {"base64": false, "type": "text/markdown", "value": "Disable HTTP/2 with `http_2_options: [enabled: false]`, which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit."}], "value": "Disable HTTP/2 with http_2_options: [enabled: false], which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Connection-level path:</p>\n<ol>\n<li>Open a stream whose response exceeds the connection send window (65,535 bytes by default).</li>\n<li>The server sends the window's worth and queues the remainder in <code>pending_sends</code>.</li>\n<li>Send <code>WINDOW_UPDATE</code> for stream 0 with an increment of 1 every few seconds, or an empty <code>SETTINGS</code> frame. Each one re-queues the remainder with a fresh deadline, so <code>expire_pending_sends/1</code> never expires it.</li>\n</ol>\n<p>Stream-level path:</p>\n<ol>\n<li>Send a large <code>WINDOW_UPDATE</code> for stream 0 so the connection window never blocks.</li>\n<li>Advertise a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code> so each stream window is tiny.</li>\n<li>Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive <code>receive</code> in <code>send_data/3</code>.</li>\n<li>Send <code>WINDOW_UPDATE</code> for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh <code>read_timeout</code>.</li>\n<li>Repeat across streams, up to <code>max_concurrent_streams</code> per connection, and across connections.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "Connection-level path:\n\n1. Open a stream whose response exceeds the connection send window (65,535 bytes by default).\n2. The server sends the window's worth and queues the remainder in `pending_sends`.\n3. Send `WINDOW_UPDATE` for stream 0 with an increment of 1 every few seconds, or an empty `SETTINGS` frame. Each one re-queues the remainder with a fresh deadline, so `expire_pending_sends/1` never expires it.\n\nStream-level path:\n\n1. Send a large `WINDOW_UPDATE` for stream 0 so the connection window never blocks.\n2. Advertise a small `SETTINGS_INITIAL_WINDOW_SIZE` so each stream window is tiny.\n3. Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive `receive` in `send_data/3`.\n4. Send `WINDOW_UPDATE` for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh `read_timeout`.\n5. Repeat across streams, up to `max_concurrent_streams` per connection, and across connections."}], "value": "Connection-level path:\n\n* Open a stream whose response exceeds the connection send window (65,535 bytes by default).\n* The server sends the window's worth and queues the remainder in pending_sends.\n* Send WINDOW_UPDATE for stream 0 with an increment of 1 every few seconds, or an empty SETTINGS frame. Each one re-queues the remainder with a fresh deadline, so expire_pending_sends/1 never expires it.\n\nStream-level path:\n\n* Send a large WINDOW_UPDATE for stream 0 so the connection window never blocks.\n* Advertise a small SETTINGS_INITIAL_WINDOW_SIZE so each stream window is tiny.\n* Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive receive in send_data/3.\n* Send WINDOW_UPDATE for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh read_timeout.\n* Repeat across streams, up to max_concurrent_streams per connection, and across connections."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Connection-level block</strong> (<code>lib/bandit/http2/connection.ex</code>)</p>\n<p>A send that outruns the connection send window is queued in <code>pending_sends</code> with an <code>expires_at</code> deadline computed in <code>finish_data/5</code> as now plus <code>@pending_send_timeout</code> (15 seconds). <code>expire_pending_sends/1</code> drops any queued send whose deadline has passed whenever data arrives on the connection. <code>do_pending_sends/2</code> runs on every <code>WINDOW_UPDATE</code> on stream 0 and on every <code>SETTINGS</code> frame (including an empty one, through <code>handle_frame/3</code>). When the granted window is smaller than the queued remainder, the leftover is re-queued through <code>finish_data/5</code>, which recomputes <code>expires_at</code> from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty <code>SETTINGS</code> frame restarts it without granting any window at all.</p>\n<p><strong>2. Stream-level block</strong> (<code>lib/bandit/http2/stream.ex</code>)</p>\n<p><code>send_data/3</code> runs in the stream process. When the stream send window is exhausted it enters a <code>receive</code> that waits for <code>{:bandit, {:send_window_update, delta}}</code> with <code>after stream.read_timeout</code> (the struct default of 15 seconds, never overridden in <code>init/5</code>). On each stream <code>WINDOW_UPDATE</code> it applies the delta and recurses into <code>send_data/3</code> with the remainder, which re-enters the same <code>receive</code> with a fresh <code>after</code> timeout. Each partial advance restarts the 15 second wait.</p>\n<p>For the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large <code>WINDOW_UPDATE</code> on stream 0 opens the connection window, and a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code> shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.</p>\n<p><strong>3. Effect</strong></p>\n<p>The trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Connection-level block** (`lib/bandit/http2/connection.ex`)\n\nA send that outruns the connection send window is queued in `pending_sends` with an `expires_at` deadline computed in `finish_data/5` as now plus `@pending_send_timeout` (15 seconds). `expire_pending_sends/1` drops any queued send whose deadline has passed whenever data arrives on the connection. `do_pending_sends/2` runs on every `WINDOW_UPDATE` on stream 0 and on every `SETTINGS` frame (including an empty one, through `handle_frame/3`). When the granted window is smaller than the queued remainder, the leftover is re-queued through `finish_data/5`, which recomputes `expires_at` from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty `SETTINGS` frame restarts it without granting any window at all.\n\n**2. Stream-level block** (`lib/bandit/http2/stream.ex`)\n\n`send_data/3` runs in the stream process. When the stream send window is exhausted it enters a `receive` that waits for `{:bandit, {:send_window_update, delta}}` with `after stream.read_timeout` (the struct default of 15 seconds, never overridden in `init/5`). On each stream `WINDOW_UPDATE` it applies the delta and recurses into `send_data/3` with the remainder, which re-enters the same `receive` with a fresh `after` timeout. Each partial advance restarts the 15 second wait.\n\nFor the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large `WINDOW_UPDATE` on stream 0 opens the connection window, and a small `SETTINGS_INITIAL_WINDOW_SIZE` shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.\n\n**3. Effect**\n\nThe trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds."}], "value": "1. Connection-level block (lib/bandit/http2/connection.ex)\n\nA send that outruns the connection send window is queued in pending_sends with an expires_at deadline computed in finish_data/5 as now plus @pending_send_timeout (15 seconds). expire_pending_sends/1 drops any queued send whose deadline has passed whenever data arrives on the connection. do_pending_sends/2 runs on every WINDOW_UPDATE on stream 0 and on every SETTINGS frame (including an empty one, through handle_frame/3). When the granted window is smaller than the queued remainder, the leftover is re-queued through finish_data/5, which recomputes expires_at from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty SETTINGS frame restarts it without granting any window at all.\n\n2. Stream-level block (lib/bandit/http2/stream.ex)\n\nsend_data/3 runs in the stream process. When the stream send window is exhausted it enters a receive that waits for {:bandit, {:send_window_update, delta}} with after stream.read_timeout (the struct default of 15 seconds, never overridden in init/5). On each stream WINDOW_UPDATE it applies the delta and recurses into send_data/3 with the remainder, which re-enters the same receive with a fresh after timeout. Each partial advance restarts the 15 second wait.\n\nFor the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large WINDOW_UPDATE on stream 0 opens the connection window, and a small SETTINGS_INITIAL_WINDOW_SIZE shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.\n\n3. Effect\n\nThe trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds."}]}, "adp": [{"references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T20:06:31.239514Z", "id": "CVE-2026-105659", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T20:07:01.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Thomas Cioppettini"}, {"lang": "en", "type": "reporter", "value": "Thomas Cioppettini"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}], "impacts": [{"capecId": "CAPEC-227", "descriptions": [{"lang": "en", "value": "A remote, unauthenticated peer requests a response larger than a send window, then drips tiny WINDOW_UPDATE frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory.", "supportingMedia": [{"type": "text/html", "value": "<p>A remote, unauthenticated peer requests a response larger than a send window, then drips tiny <code>WINDOW_UPDATE</code> frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory.</p>", "base64": false}, {"type": "text/markdown", "value": "A remote, unauthenticated peer requests a response larger than a send window, then drips tiny `WINDOW_UPDATE` frames every few seconds. Each blocked stream process, with its Plug state and any upstream connection or file handle it holds, stays alive for as long as the trickle continues. Repeated across many streams and connections this exhausts server processes and memory.", "base64": false}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "product": "bandit", "versions": [{"status": "affected", "version": "1.4.0", "lessThan": "1.13.0", "versionType": "semver"}], "packageURL": "pkg:hex/bandit", "packageName": "bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}]}, {"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "product": "bandit", "versions": [{"status": "affected", "version": "fff06efe3be962b484bd4d3eb339372fda5a231f", "lessThan": "d88b21953c65061f21136ea76a89a4f95a2ac7a1", "versionType": "git"}], "packageURL": "pkg:github/mtrudel/bandit", "packageName": "mtrudel/bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}]}], "datePublic": "2026-10-14T16:54:46.000Z", "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf", "name": "GitHub Advisory", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-105659.html", "name": "EEF CNA record for CVE-2026-105659", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105659", "name": "OSV record EEF-CVE-2026-105659", "tags": ["related"]}, {"url": "https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f", "name": "Introducing commit fff06ef in mtrudel/bandit", "tags": ["related"]}, {"url": "https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1", "name": "Fix commit d88b219 in mtrudel/bandit", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Disable HTTP/2 with http_2_options: [enabled: false], which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit.", "supportingMedia": [{"type": "text/html", "value": "<p>Disable HTTP/2 with <code>http_2_options: [enabled: false]</code>, which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit.</p>", "base64": false}, {"type": "text/markdown", "value": "Disable HTTP/2 with `http_2_options: [enabled: false]`, which removes both vulnerable paths. Alternatively, terminate HTTP/2 at a reverse proxy that enforces its own send timeouts and speaks HTTP/1 to Bandit.", "base64": false}]}], "dateAssigned": "2026-10-12T16:13:25.000Z", "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small <code>WINDOW_UPDATE</code> frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. <code>Bandit.HTTP2.Connection.finish_data/5</code> re-queues a partially advanced send in <code>pending_sends</code> with a fresh <code>expires_at</code>, so every <code>WINDOW_UPDATE</code> on stream 0, and every <code>SETTINGS</code> frame, resets the clock. <code>Bandit.HTTP2.Stream.send_data/3</code> recurses on each stream <code>WINDOW_UPDATE</code> and re-arms a fresh <code>after read_timeout</code>. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.</p>\n<p>The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large <code>WINDOW_UPDATE</code> on stream 0 and shrinking the per-stream window with a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code>, so closing only the connection-level path leaves it exploitable.</p>\n<p>This issue affects bandit: from 1.4.0 before 1.13.0.</p>", "base64": false}, {"type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small `WINDOW_UPDATE` frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. `Bandit.HTTP2.Connection.finish_data/5` re-queues a partially advanced send in `pending_sends` with a fresh `expires_at`, so every `WINDOW_UPDATE` on stream 0, and every `SETTINGS` frame, resets the clock. `Bandit.HTTP2.Stream.send_data/3` recurses on each stream `WINDOW_UPDATE` and re-arms a fresh `after read_timeout`. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large `WINDOW_UPDATE` on stream 0 and shrinking the per-stream window with a small `SETTINGS_INITIAL_WINDOW_SIZE`, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.13.0", "versionStartIncluding": "1.4.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-15T18:37:59.434Z"}, "x_proofOfConcept": [{"lang": "en", "value": "Connection-level path:\n\n* Open a stream whose response exceeds the connection send window (65,535 bytes by default).\n* The server sends the window's worth and queues the remainder in pending_sends.\n* Send WINDOW_UPDATE for stream 0 with an increment of 1 every few seconds, or an empty SETTINGS frame. Each one re-queues the remainder with a fresh deadline, so expire_pending_sends/1 never expires it.\n\nStream-level path:\n\n* Send a large WINDOW_UPDATE for stream 0 so the connection window never blocks.\n* Advertise a small SETTINGS_INITIAL_WINDOW_SIZE so each stream window is tiny.\n* Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive receive in send_data/3.\n* Send WINDOW_UPDATE for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh read_timeout.\n* Repeat across streams, up to max_concurrent_streams per connection, and across connections.", "supportingMedia": [{"type": "text/html", "value": "<p>Connection-level path:</p>\n<ol>\n<li>Open a stream whose response exceeds the connection send window (65,535 bytes by default).</li>\n<li>The server sends the window's worth and queues the remainder in <code>pending_sends</code>.</li>\n<li>Send <code>WINDOW_UPDATE</code> for stream 0 with an increment of 1 every few seconds, or an empty <code>SETTINGS</code> frame. Each one re-queues the remainder with a fresh deadline, so <code>expire_pending_sends/1</code> never expires it.</li>\n</ol>\n<p>Stream-level path:</p>\n<ol>\n<li>Send a large <code>WINDOW_UPDATE</code> for stream 0 so the connection window never blocks.</li>\n<li>Advertise a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code> so each stream window is tiny.</li>\n<li>Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive <code>receive</code> in <code>send_data/3</code>.</li>\n<li>Send <code>WINDOW_UPDATE</code> for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh <code>read_timeout</code>.</li>\n<li>Repeat across streams, up to <code>max_concurrent_streams</code> per connection, and across connections.</li>\n</ol>", "base64": false}, {"type": "text/markdown", "value": "Connection-level path:\n\n1. Open a stream whose response exceeds the connection send window (65,535 bytes by default).\n2. The server sends the window's worth and queues the remainder in `pending_sends`.\n3. Send `WINDOW_UPDATE` for stream 0 with an increment of 1 every few seconds, or an empty `SETTINGS` frame. Each one re-queues the remainder with a fresh deadline, so `expire_pending_sends/1` never expires it.\n\nStream-level path:\n\n1. Send a large `WINDOW_UPDATE` for stream 0 so the connection window never blocks.\n2. Advertise a small `SETTINGS_INITIAL_WINDOW_SIZE` so each stream window is tiny.\n3. Request a response larger than the stream window. The server sends the window's worth and blocks in the recursive `receive` in `send_data/3`.\n4. Send `WINDOW_UPDATE` for the stream with an increment of 1 at intervals shorter than 15 seconds. Each one re-arms a fresh `read_timeout`.\n5. Repeat across streams, up to `max_concurrent_streams` per connection, and across connections.", "base64": false}]}], "x_technicalAnalysis": [{"lang": "en", "value": "1. Connection-level block (lib/bandit/http2/connection.ex)\n\nA send that outruns the connection send window is queued in pending_sends with an expires_at deadline computed in finish_data/5 as now plus @pending_send_timeout (15 seconds). expire_pending_sends/1 drops any queued send whose deadline has passed whenever data arrives on the connection. do_pending_sends/2 runs on every WINDOW_UPDATE on stream 0 and on every SETTINGS frame (including an empty one, through handle_frame/3). When the granted window is smaller than the queued remainder, the leftover is re-queued through finish_data/5, which recomputes expires_at from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty SETTINGS frame restarts it without granting any window at all.\n\n2. Stream-level block (lib/bandit/http2/stream.ex)\n\nsend_data/3 runs in the stream process. When the stream send window is exhausted it enters a receive that waits for {:bandit, {:send_window_update, delta}} with after stream.read_timeout (the struct default of 15 seconds, never overridden in init/5). On each stream WINDOW_UPDATE it applies the delta and recurses into send_data/3 with the remainder, which re-enters the same receive with a fresh after timeout. Each partial advance restarts the 15 second wait.\n\nFor the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large WINDOW_UPDATE on stream 0 opens the connection window, and a small SETTINGS_INITIAL_WINDOW_SIZE shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.\n\n3. Effect\n\nThe trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds.", "supportingMedia": [{"type": "text/html", "value": "<p><strong>1. Connection-level block</strong> (<code>lib/bandit/http2/connection.ex</code>)</p>\n<p>A send that outruns the connection send window is queued in <code>pending_sends</code> with an <code>expires_at</code> deadline computed in <code>finish_data/5</code> as now plus <code>@pending_send_timeout</code> (15 seconds). <code>expire_pending_sends/1</code> drops any queued send whose deadline has passed whenever data arrives on the connection. <code>do_pending_sends/2</code> runs on every <code>WINDOW_UPDATE</code> on stream 0 and on every <code>SETTINGS</code> frame (including an empty one, through <code>handle_frame/3</code>). When the granted window is smaller than the queued remainder, the leftover is re-queued through <code>finish_data/5</code>, which recomputes <code>expires_at</code> from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty <code>SETTINGS</code> frame restarts it without granting any window at all.</p>\n<p><strong>2. Stream-level block</strong> (<code>lib/bandit/http2/stream.ex</code>)</p>\n<p><code>send_data/3</code> runs in the stream process. When the stream send window is exhausted it enters a <code>receive</code> that waits for <code>{:bandit, {:send_window_update, delta}}</code> with <code>after stream.read_timeout</code> (the struct default of 15 seconds, never overridden in <code>init/5</code>). On each stream <code>WINDOW_UPDATE</code> it applies the delta and recurses into <code>send_data/3</code> with the remainder, which re-enters the same <code>receive</code> with a fresh <code>after</code> timeout. Each partial advance restarts the 15 second wait.</p>\n<p>For the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large <code>WINDOW_UPDATE</code> on stream 0 opens the connection window, and a small <code>SETTINGS_INITIAL_WINDOW_SIZE</code> shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.</p>\n<p><strong>3. Effect</strong></p>\n<p>The trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds.</p>", "base64": false}, {"type": "text/markdown", "value": "**1. Connection-level block** (`lib/bandit/http2/connection.ex`)\n\nA send that outruns the connection send window is queued in `pending_sends` with an `expires_at` deadline computed in `finish_data/5` as now plus `@pending_send_timeout` (15 seconds). `expire_pending_sends/1` drops any queued send whose deadline has passed whenever data arrives on the connection. `do_pending_sends/2` runs on every `WINDOW_UPDATE` on stream 0 and on every `SETTINGS` frame (including an empty one, through `handle_frame/3`). When the granted window is smaller than the queued remainder, the leftover is re-queued through `finish_data/5`, which recomputes `expires_at` from the current time instead of preserving the original deadline. Each partial advance therefore restarts the timer, and an empty `SETTINGS` frame restarts it without granting any window at all.\n\n**2. Stream-level block** (`lib/bandit/http2/stream.ex`)\n\n`send_data/3` runs in the stream process. When the stream send window is exhausted it enters a `receive` that waits for `{:bandit, {:send_window_update, delta}}` with `after stream.read_timeout` (the struct default of 15 seconds, never overridden in `init/5`). On each stream `WINDOW_UPDATE` it applies the delta and recurses into `send_data/3` with the remainder, which re-enters the same `receive` with a fresh `after` timeout. Each partial advance restarts the 15 second wait.\n\nFor the stream-level block to be the one stuck, the stream window must be exhausted while the connection window has room. The peer controls both: a large `WINDOW_UPDATE` on stream 0 opens the connection window, and a small `SETTINGS_INITIAL_WINDOW_SIZE` shrinks every stream window. Closing only the connection-level path therefore leaves the stream-level path fully exploitable.\n\n**3. Effect**\n\nThe trickle also keeps the transport-level read timeout from firing, since the connection continuously receives valid frames. The blocked stream process, its Plug state, and anything it holds mid-response stay retained for as long as the peer keeps dripping, instead of being released after 15 seconds.", "base64": false}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105659", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T20:06:31.239514Z"}}}], "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-16T20:06:53.474Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-105659", "state": "PUBLISHED", "dateUpdated": "2026-10-15T18:37:59.434Z", "dateReserved": "2026-10-12T10:00:01.326Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-10-14T16:54:46.484Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.13.0", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.HTTP2.Connection'", "'Elixir.Bandit.HTTP2.Stream'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/http2/connection.ex", "lib/bandit/http2/stream.ex"], "programRoutines": [{"name": "'Elixir.Bandit.HTTP2.Connection':finish_data/5"}, {"name": "'Elixir.Bandit.HTTP2.Connection':do_pending_sends/2"}, {"name": "'Elixir.Bandit.HTTP2.Connection':handle_frame/3"}, {"name": "'Elixir.Bandit.HTTP2.Stream':send_data/3"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "d88b21953c65061f21136ea76a89a4f95a2ac7a1", "status": "affected", "version": "fff06efe3be962b484bd4d3eb339372fda5a231f", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\n\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\n\nThis issue affects bandit: from 1.4.0 before 1.13.0."}], "id": "CVE-2026-105659", "lastModified": "2026-10-16T21:17:16.480", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105659", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T20:06:31.239514Z", "version": "2.0.3"}}]}, "published": "2026-10-14T17:18:15.657", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-105659.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105659"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,1.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fff06efe3be962b484bd4d3eb339372fda5a231f,d88b21953c65061f21136ea76a89a4f95a2ac7a1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}], "created": "2026-10-14T23:45:09.406396+00:00", "updated": "2026-10-17T05:15:02.898958+00:00", "vendors": ["mtrudel", "mtrudel$PRODUCT$bandit"]}