CVE-2026-42788: HTTP/2 Frame Size Limit Bypass and Memory Exhaustion in Bandit

Vulnerability ID: CVE-2026-42788

CVSS Score: 6.9

Published: 2026-05-07

CVE-2026-42788 is a critical resource management vulnerability in the Bandit HTTP server for Elixir. The flaw exists within the HTTP/2 frame deserialization logic, where binary pattern matching defers size validation until after memory allocation. This allows an unauthenticated remote attacker to cause memory exhaustion and Denial of Service by transmitting oversized HTTP/2 frames.

TL;DR

Unauthenticated remote attackers can trigger Denial of Service in the Bandit Elixir HTTP server via memory exhaustion by sending oversized HTTP/2 frames, bypassing size limits due to deferred buffer validation in pattern matching.

Technical Details

CWE ID : CWE-770

Attack Vector : Network

CVSS v4.0 : 6.9

EPSS Score : 0.00017

Impact : Denial of Service (DoS)

Exploit Status : None

CISA KEV : Not Listed

Affected Systems

bandit (Elixir HTTP server)

bandit : 0.3.6…