{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"bandit","packageURL":"pkg:hex/bandit","product":"bandit","repo":"https://github.com/mtrudel/bandit","vendor":"mtrudel","versions":[{"lessThan":"1.14.0","status":"affected","version":"0.3.6","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"mtrudel/bandit","packageURL":"pkg:github/mtrudel/bandit","product":"bandit","repo":"https://github.com/mtrudel/bandit","vendor":"mtrudel","versions":[{"lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","status":"affected","version":"0e68313fab9d204257ebad5c447e4cd9cea8e0ea","versionType":"git"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"0.3.6","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"reporter","value":"Peter Ullrich"},{"lang":"en","type":"remediation developer","value":"Mat Trudel"},{"lang":"en","type":"analyst","value":"Jonatan Männchen / EEF"}],"dateAssigned":"2026-10-23T10:42:03.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large <code>SETTINGS_HEADER_TABLE_SIZE</code>. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as <code>date</code> or <code>content-length</code>, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.</p>\n<p>The SETTINGS handling in <code>Bandit.HTTP2.Connection</code> (<code>lib/bandit/http2/connection.ex</code>) passes <code>remote_settings.header_table_size</code> to <code>HPAX.resize/2</code> with no server-side cap, and <code>encode_headers</code> encodes every response header as <code>:store</code>. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.</p>\n<p>This issue affects bandit: from 0.3.6 before 1.14.0.</p>"},{"base64":false,"type":"text/markdown","value":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large `SETTINGS_HEADER_TABLE_SIZE`. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as `date` or `content-length`, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in `Bandit.HTTP2.Connection` (`lib/bandit/http2/connection.ex`) passes `remote_settings.header_table_size` to `HPAX.resize/2` with no server-side cap, and `encode_headers` encodes every response header as `:store`. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0."}],"value":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0."}],"impacts":[{"capecId":"CAPEC-125","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.</p>"},{"base64":false,"type":"text/markdown","value":"An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive."}],"value":"An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive."}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-26T13:32:38.613Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"name":"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit","tags":["vendor-advisory","related"],"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr"},{"name":"EEF CNA record for CVE-2026-110499","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-110499.html"},{"name":"OSV record EEF-CVE-2026-110499","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-110499"},{"name":"Introducing commit 0e68313 in mtrudel/bandit","tags":["related"],"url":"https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea"},{"name":"Fix commit 220b9df in mtrudel/bandit","tags":["patch"],"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}],"source":{"discovery":"UNKNOWN"},"title":"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with <code>http_2_options: [max_requests: 1000]</code>, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with <code>http_2_options: [enabled: false]</code>.</p>"},{"base64":false,"type":"text/markdown","value":"From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with `http_2_options: [max_requests: 1000]`, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with `http_2_options: [enabled: false]`."}],"value":"From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with http_2_options: [max_requests: 1000], so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with http_2_options: [enabled: false]."}],"x_proofOfConcept":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<ol>\n<li>Open an HTTP/2 connection and advertise a <code>SETTINGS_HEADER_TABLE_SIZE</code> of 4294967295 in the initial SETTINGS frame.</li>\n<li>Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.</li>\n<li>Time the round trips. In the reporter's run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.</li>\n</ol>"},{"base64":false,"type":"text/markdown","value":"1. Open an HTTP/2 connection and advertise a `SETTINGS_HEADER_TABLE_SIZE` of 4294967295 in the initial SETTINGS frame.\n2. Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\n3. Time the round trips. In the reporter's run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000."}],"value":"* Open an HTTP/2 connection and advertise a SETTINGS_HEADER_TABLE_SIZE of 4294967295 in the initial SETTINGS frame.\n* Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\n* Time the round trips. In the reporter's run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000."}],"x_technicalAnalysis":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p><strong>1. Table size</strong> (<code>lib/bandit/http2/connection.ex</code>)</p>\n<p>On every SETTINGS frame, <code>Bandit.HTTP2.Connection</code> passes the peer's <code>SETTINGS_HEADER_TABLE_SIZE</code> straight to <code>HPAX.resize/2</code> for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.</p>\n<p><strong>2. Indexing</strong></p>\n<p><code>encode_headers</code> encodes every response header as <code>:store</code>, adding it to the dynamic table. Headers whose values differ per response (<code>date</code>, <code>content-length</code>, <code>set-cookie</code>, <code>x-request-id</code>, a reflected <code>location</code>) produce new entries, and with a limit of about 4 GB none are evicted.</p>\n<p><strong>3. Cost</strong></p>\n<p>HPAX's <code>lookup_by_header</code> scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N²) CPU in the connection process, and the table holds every entry for as long as the connection stays open.</p>"},{"base64":false,"type":"text/markdown","value":"**1. Table size** (`lib/bandit/http2/connection.ex`)\n\nOn every SETTINGS frame, `Bandit.HTTP2.Connection` passes the peer's `SETTINGS_HEADER_TABLE_SIZE` straight to `HPAX.resize/2` for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\n\n**2. Indexing**\n\n`encode_headers` encodes every response header as `:store`, adding it to the dynamic table. Headers whose values differ per response (`date`, `content-length`, `set-cookie`, `x-request-id`, a reflected `location`) produce new entries, and with a limit of about 4 GB none are evicted.\n\n**3. Cost**\n\nHPAX's `lookup_by_header` scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N²) CPU in the connection process, and the table holds every entry for as long as the connection stays open."}],"value":"1. Table size (lib/bandit/http2/connection.ex)\n\nOn every SETTINGS frame, Bandit.HTTP2.Connection passes the peer's SETTINGS_HEADER_TABLE_SIZE straight to HPAX.resize/2 for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\n\n2. Indexing\n\nencode_headers encodes every response header as :store, adding it to the dynamic table. Headers whose values differ per response (date, content-length, set-cookie, x-request-id, a reflected location) produce new entries, and with a limit of about 4 GB none are evicted.\n\n3. Cost\n\nHPAX's lookup_by_header scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N²) CPU in the connection process, and the table holds every entry for as long as the connection stays open."}]}},"cveMetadata":{"assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","assignerShortName":"EEF","cveId":"CVE-2026-110499","datePublished":"2026-10-26T13:32:38.613Z","dateReserved":"2026-10-22T09:30:02.077Z","dateUpdated":"2026-10-26T13:32:38.613Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}