CVE-2026-110499

CVE-2026-110499 · Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly. The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process. This issue affects bandit: from 0.3.6 before 1.14.0.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published

2026-10-26T13:32:38.613Z

Updated

2026-10-26T15:35:50.929Z

Stack: system

Check your server →