CVE-2026-108529 - SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
CVE ID :CVE-2026-108529 Published : Oct. 26, 2026, 1:35 p.m. | 47 minutes ago Description :Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level...