CVE-2026-105659 - HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
CVE ID :CVE-2026-105659 Published : Oct. 14, 2026, 5:18 p.m. | 14 minutes ago Description :Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A...