{"metadata": {"vulnerability": "CVE-2026-105659", "count": 12, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-12T10:00:01.326Z", "date_only": false, "value": "2026-10-12T10:00:01.326Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-105659", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T16:13:25Z", "date_only": false, "value": "2026-10-12T16:13:25.000Z", "kind": "other", "label": "Date Assigned", "source": "cvelistv5 / EEF", "record": "CVE-2026-105659", "field": "containers.cna.dateAssigned"}, {"timestamp": "2026-10-14T16:54:46Z", "date_only": false, "value": "2026-10-14T16:54:46.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / EEF", "record": "CVE-2026-105659", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T16:54:46.484Z", "date_only": false, "value": "2026-10-14T16:54:46.484Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105659", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T17:18:15.657Z", "date_only": false, "value": "2026-10-14T17:18:15.657", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105659", "record": "FKIE_CVE-2026-105659", "field": "published"}, {"timestamp": "2026-10-14T22:43:56.650Z", "date_only": false, "value": "2026-10-14T22:43:56.650114Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441680910158710", "record": "CVE-2026-105659", "field": "creation_timestamp", "uuid": "45f43da0-3744-41bc-8a71-d613fd1f73ac", "content": "CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.\nThe two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.\nThis issue affects bandit: from 1.4.0 onward.\nhttps://www.cve.org/CVERecord?id=CVE-2026-105659https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcfhttps://cna.erlef.org/cves/CVE-2026-105659.htmlhttps://osv.dev/vulnerability/EEF-CVE-2026-105659https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231fhttps://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1#mtrudel #bandit#CVE_2026_105659#bot", "url": "https://infosec.exchange/users/cve/statuses/117441680910158710"}, {"timestamp": "2026-10-15T18:37:59.434Z", "date_only": false, "value": "2026-10-15T18:37:59.434Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-105659", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:06:31.239Z", "date_only": false, "value": "2026-10-16T20:06:31.239514Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105659", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T20:06:31.239Z", "date_only": false, "value": "2026-10-16T20:06:31.239514Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105659", "record": "FKIE_CVE-2026-105659", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T20:07:01.914Z", "date_only": false, "value": "2026-10-16T20:07:01.914Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-105659", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:07:01.914Z", "date_only": false, "value": "2026-10-16T20:07:01.914Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105659", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:17:16.480Z", "date_only": false, "value": "2026-10-16T21:17:16.480", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105659", "record": "FKIE_CVE-2026-105659", "field": "lastModified"}]}