HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Summary

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory.

Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR.

This issue affects bandit: from 0.3.1 before 1.14.0.

Details

1. Connection-level window (lib/bandit/http2/connection.ex, lib/bandit/http2/flow_control.ex)

The handle_frame/3 clause for DATA frames sends the payload to the stream process before any window is checked. It then calls compute_recv_window/2, which subtracts the frame size and, once the window drops below 2^30, advertises a WINDOW_UPDATE back up to 2^31-1. A negative window is accepted, so a peer that overruns the window is never refused, and the window refills when data arrives rather than when it is consumed.

2. Stream-level window (lib/bandit/http2/stream.ex)

The stream receive window is debited only when the stream process reads the DATA message, and it never rejects a violation either.

3. Accumulation

While send_data/3 waits for send window, its selective receive matches only window updates and resets, so DATA messages pile up unread in the mailbox. A stream WINDOW_UPDATE of 1 byte, sent at intervals under the 15-second send timeout, keeps the stream alive while the attacker floods 1-byte DATA frames.

Proof of concept

1. On an HTTP/2 connection, request a resource whose response exceeds 65,535 bytes and send no WINDOW_UPDATE. The server sends one window's worth and the stream blocks in send_data/3.
2. Send 1-byte DATA frames on that stream in batches, ignoring the server's receive windows.
3. Between batches, at intervals under 15 seconds, send a stream WINDOW_UPDATE with an increment of 1 to keep the blocked send alive.
4. Send a PING. It is acknowledged, and the server has sent neither FLOW_CONTROL_ERROR nor GOAWAY while its memory grows with every frame.

Impact

An unauthenticated remote client can exhaust the memory of any Bandit server with HTTP/2 enabled by flooding DATA frames on a stream that is not reading its request body, such as one stalled sending a large response. The queued frames live in the BEAM node's memory, so exhausting it takes down every application on the node, not just the HTTP listener.

Workarounds

From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false], which removes the vulnerable path.