CVE-2026-108525 - HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
CVE ID :CVE-2026-108525 Published : Oct. 26, 2026, 1:29 p.m. | 53 minutes ago Description :Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent...