{"id":"CVE-2026-110499","aliases":[],"cve":{"records":[{"id":"CVE-2026-110499","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T09:30:02.077Z","published":"2026-10-26T13:32:38.613Z","modified":"2026-10-26T15:35:50.929Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-26T13:32:38.613Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T15:35:50.929Z"}],"references":[{"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-110499.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-110499","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a","tags":["patch"],"source":"EEF"}],"weaknesses":[{"id":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"0.3.6","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T15:02:00.207666Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit","titleSource":"EEF","descriptionSource":"EEF","description":"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0.","score":8.7,"severity":"high","published":"2026-10-26T13:32:38.613Z","modified":"2026-10-26T15:35:50.929Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"0.3.6","status":"affected","lessThan":"1.14.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/bandit","packageIdentity":{"ecosystem":"Hex","name":"bandit"},"cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-110499"},{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"0e68313fab9d204257ebad5c447e4cd9cea8e0ea","status":"affected","lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/mtrudel/bandit","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-110499"}],"remediation":[{"text":"From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with http_2_options: [max_requests: 1000], so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with http_2_options: [enabled: false].","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-110499"}],"references":["https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr","https://cna.erlef.org/cves/CVE-2026-110499.html","https://osv.dev/vulnerability/EEF-CVE-2026-110499","https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea","https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"],"sources":[{"name":"CVE","id":"CVE-2026-110499","modified":"2026-10-26T15:35:50.929Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110499"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:29:35.549Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Bandit HTTP/2 implementation has an Allocation of Resources Without Limits or Throttling vulnerability, allowing an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound. This affects bandit versions from 0.3.6 before 1.14.0. The attacker can exploit this by sending a large SETTINGS_HEADER_TABLE_SIZE.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:37:07.485Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-110499"}]}}