Quadratic bignum parsing of Content-Length and Host port values in Bandit
Impact
Bandit versions before 1.14.0 have an inefficient algorithmic complexity vulnerability, allowing an unauthenticated remote attacker to consume server CPU with a large Content-Length or Host port value. The issue affects versions from 1.0.0-pre.7. An attacker can send a value with thousands of digits to exploit this weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
mtrudel · EEF
bandit
1 range
mtrudel · EEF
bandit
Package identity
pkg:hex/banditExplore bandit →Identity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.0.0-pre.7 → before 1.14.0
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*mtrudel · EEF
bandit
1 range
mtrudel · EEF
bandit
Package identity
pkg:github/mtrudel/banditIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
e0c8c0c30af9b0f57d8aafac37ddd9294363a8be → before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a
git versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*Original source description
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.
Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.
This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-113436View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*From (inclusive): 1.0.0-pre.7
Before: 1.14.0
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.0",
"versionStartIncluding": "1.0.0-pre.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.