{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:02:00.207666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:35:50.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "0.3.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "0e68313fab9d204257ebad5c447e4cd9cea8e0ea",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.14.0",
                  "versionStartIncluding": "0.3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mat Trudel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-23T10:42:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as \u003ccode\u003edate\u003c/code\u003e or \u003ccode\u003econtent-length\u003c/code\u003e, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\u003c/p\u003e\n\u003cp\u003eThe SETTINGS handling in \u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e) passes \u003ccode\u003eremote_settings.header_table_size\u003c/code\u003e to \u003ccode\u003eHPAX.resize/2\u003c/code\u003e with no server-side cap, and \u003ccode\u003eencode_headers\u003c/code\u003e encodes every response header as \u003ccode\u003e:store\u003c/code\u003e. Serving N responses on one connection therefore costs O(N\u00b2) CPU in the connection process.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.3.6 before 1.14.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large `SETTINGS_HEADER_TABLE_SIZE`. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as `date` or `content-length`, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in `Bandit.HTTP2.Connection` (`lib/bandit/http2/connection.ex`) passes `remote_settings.header_table_size` to `HPAX.resize/2` with no server-side cap, and `encode_headers` encodes every response header as `:store`. Serving N responses on one connection therefore costs O(N\u00b2) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N\u00b2) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-125",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive."
                }
              ],
              "value": "An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:32:38.613Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr"
        },
        {
          "name": "EEF CNA record for CVE-2026-110499",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-110499.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-110499",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-110499"
        },
        {
          "name": "Introducing commit 0e68313 in mtrudel/bandit",
          "tags": [
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea"
        },
        {
          "name": "Fix commit 220b9df in mtrudel/bandit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFrom 0.7.0, cap the requests one HTTP/2 connection may serve, for example with \u003ccode\u003ehttp_2_options: [max_requests: 1000]\u003c/code\u003e, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with `http_2_options: [max_requests: 1000]`, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with `http_2_options: [enabled: false]`."
            }
          ],
          "value": "From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with http_2_options: [max_requests: 1000], so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with http_2_options: [enabled: false]."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eOpen an HTTP/2 connection and advertise a \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e of 4294967295 in the initial SETTINGS frame.\u003c/li\u003e\n\u003cli\u003eSend cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\u003c/li\u003e\n\u003cli\u003eTime the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Open an HTTP/2 connection and advertise a `SETTINGS_HEADER_TABLE_SIZE` of 4294967295 in the initial SETTINGS frame.\n2. Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\n3. Time the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000."
            }
          ],
          "value": "* Open an HTTP/2 connection and advertise a SETTINGS_HEADER_TABLE_SIZE of 4294967295 in the initial SETTINGS frame.\n* Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\n* Time the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Table size\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eOn every SETTINGS frame, \u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e passes the peer\u0027s \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e straight to \u003ccode\u003eHPAX.resize/2\u003c/code\u003e for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Indexing\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eencode_headers\u003c/code\u003e encodes every response header as \u003ccode\u003e:store\u003c/code\u003e, adding it to the dynamic table. Headers whose values differ per response (\u003ccode\u003edate\u003c/code\u003e, \u003ccode\u003econtent-length\u003c/code\u003e, \u003ccode\u003eset-cookie\u003c/code\u003e, \u003ccode\u003ex-request-id\u003c/code\u003e, a reflected \u003ccode\u003elocation\u003c/code\u003e) produce new entries, and with a limit of about 4 GB none are evicted.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Cost\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eHPAX\u0027s \u003ccode\u003elookup_by_header\u003c/code\u003e scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Table size** (`lib/bandit/http2/connection.ex`)\n\nOn every SETTINGS frame, `Bandit.HTTP2.Connection` passes the peer\u0027s `SETTINGS_HEADER_TABLE_SIZE` straight to `HPAX.resize/2` for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\n\n**2. Indexing**\n\n`encode_headers` encodes every response header as `:store`, adding it to the dynamic table. Headers whose values differ per response (`date`, `content-length`, `set-cookie`, `x-request-id`, a reflected `location`) produce new entries, and with a limit of about 4 GB none are evicted.\n\n**3. Cost**\n\nHPAX\u0027s `lookup_by_header` scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open."
            }
          ],
          "value": "1. Table size (lib/bandit/http2/connection.ex)\n\nOn every SETTINGS frame, Bandit.HTTP2.Connection passes the peer\u0027s SETTINGS_HEADER_TABLE_SIZE straight to HPAX.resize/2 for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\n\n2. Indexing\n\nencode_headers encodes every response header as :store, adding it to the dynamic table. Headers whose values differ per response (date, content-length, set-cookie, x-request-id, a reflected location) produce new entries, and with a limit of about 4 GB none are evicted.\n\n3. Cost\n\nHPAX\u0027s lookup_by_header scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-110499",
    "datePublished": "2026-10-26T13:32:38.613Z",
    "dateReserved": "2026-10-22T09:30:02.077Z",
    "dateUpdated": "2026-10-26T15:35:50.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-110499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-26T15:02:00.207666Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-26T15:32:29.839Z\"}}], \"cna\": {\"title\": \"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Mat Trudel\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-125\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.\", \"base64\": false}]}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.3.6\", \"lessThan\": \"1.14.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/bandit\", \"packageName\": \"bandit\", \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0e68313fab9d204257ebad5c447e4cd9cea8e0ea\", \"lessThan\": \"220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/mtrudel/bandit\", \"packageName\": \"mtrudel/bandit\", \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr\", \"name\": \"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-110499.html\", \"name\": \"EEF CNA record for CVE-2026-110499\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-110499\", \"name\": \"OSV record EEF-CVE-2026-110499\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea\", \"name\": \"Introducing commit 0e68313 in mtrudel/bandit\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"name\": \"Fix commit 220b9df in mtrudel/bandit\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with http_2_options: [max_requests: 1000], so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with http_2_options: [enabled: false].\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFrom 0.7.0, cap the requests one HTTP/2 connection may serve, for example with \u003ccode\u003ehttp_2_options: [max_requests: 1000]\u003c/code\u003e, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with `http_2_options: [max_requests: 1000]`, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with `http_2_options: [enabled: false]`.\", \"base64\": false}]}], \"dateAssigned\": \"2026-10-23T10:42:03.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\\n\\nThe SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N\\u00b2) CPU in the connection process.\\n\\nThis issue affects bandit: from 0.3.6 before 1.14.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as \u003ccode\u003edate\u003c/code\u003e or \u003ccode\u003econtent-length\u003c/code\u003e, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\u003c/p\u003e\\n\u003cp\u003eThe SETTINGS handling in \u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e) passes \u003ccode\u003eremote_settings.header_table_size\u003c/code\u003e to \u003ccode\u003eHPAX.resize/2\u003c/code\u003e with no server-side cap, and \u003ccode\u003eencode_headers\u003c/code\u003e encodes every response header as \u003ccode\u003e:store\u003c/code\u003e. Serving N responses on one connection therefore costs O(N\\u00b2) CPU in the connection process.\u003c/p\u003e\\n\u003cp\u003eThis issue affects bandit: from 0.3.6 before 1.14.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large `SETTINGS_HEADER_TABLE_SIZE`. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as `date` or `content-length`, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\\n\\nThe SETTINGS handling in `Bandit.HTTP2.Connection` (`lib/bandit/http2/connection.ex`) passes `remote_settings.header_table_size` to `HPAX.resize/2` with no server-side cap, and `encode_headers` encodes every response header as `:store`. Serving N responses on one connection therefore costs O(N\\u00b2) CPU in the connection process.\\n\\nThis issue affects bandit: from 0.3.6 before 1.14.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.14.0\", \"versionStartIncluding\": \"0.3.6\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-10-26T13:32:38.613Z\"}, \"x_proofOfConcept\": [{\"lang\": \"en\", \"value\": \"* Open an HTTP/2 connection and advertise a SETTINGS_HEADER_TABLE_SIZE of 4294967295 in the initial SETTINGS frame.\\n* Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\\n* Time the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003col\u003e\\n\u003cli\u003eOpen an HTTP/2 connection and advertise a \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e of 4294967295 in the initial SETTINGS frame.\u003c/li\u003e\\n\u003cli\u003eSend cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\u003c/li\u003e\\n\u003cli\u003eTime the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.\u003c/li\u003e\\n\u003c/ol\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"1. Open an HTTP/2 connection and advertise a `SETTINGS_HEADER_TABLE_SIZE` of 4294967295 in the initial SETTINGS frame.\\n2. Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\\n3. Time the round trips. In the reporter\u0027s run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.\", \"base64\": false}]}], \"x_technicalAnalysis\": [{\"lang\": \"en\", \"value\": \"1. Table size (lib/bandit/http2/connection.ex)\\n\\nOn every SETTINGS frame, Bandit.HTTP2.Connection passes the peer\u0027s SETTINGS_HEADER_TABLE_SIZE straight to HPAX.resize/2 for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\\n\\n2. Indexing\\n\\nencode_headers encodes every response header as :store, adding it to the dynamic table. Headers whose values differ per response (date, content-length, set-cookie, x-request-id, a reflected location) produce new entries, and with a limit of about 4 GB none are evicted.\\n\\n3. Cost\\n\\nHPAX\u0027s lookup_by_header scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cstrong\u003e1. Table size\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e)\u003c/p\u003e\\n\u003cp\u003eOn every SETTINGS frame, \u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e passes the peer\u0027s \u003ccode\u003eSETTINGS_HEADER_TABLE_SIZE\u003c/code\u003e straight to \u003ccode\u003eHPAX.resize/2\u003c/code\u003e for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e2. Indexing\u003c/strong\u003e\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eencode_headers\u003c/code\u003e encodes every response header as \u003ccode\u003e:store\u003c/code\u003e, adding it to the dynamic table. Headers whose values differ per response (\u003ccode\u003edate\u003c/code\u003e, \u003ccode\u003econtent-length\u003c/code\u003e, \u003ccode\u003eset-cookie\u003c/code\u003e, \u003ccode\u003ex-request-id\u003c/code\u003e, a reflected \u003ccode\u003elocation\u003c/code\u003e) produce new entries, and with a limit of about 4 GB none are evicted.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e3. Cost\u003c/strong\u003e\u003c/p\u003e\\n\u003cp\u003eHPAX\u0027s \u003ccode\u003elookup_by_header\u003c/code\u003e scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"**1. Table size** (`lib/bandit/http2/connection.ex`)\\n\\nOn every SETTINGS frame, `Bandit.HTTP2.Connection` passes the peer\u0027s `SETTINGS_HEADER_TABLE_SIZE` straight to `HPAX.resize/2` for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\\n\\n**2. Indexing**\\n\\n`encode_headers` encodes every response header as `:store`, adding it to the dynamic table. Headers whose values differ per response (`date`, `content-length`, `set-cookie`, `x-request-id`, a reflected `location`) produce new entries, and with a limit of about 4 GB none are evicted.\\n\\n**3. Cost**\\n\\nHPAX\u0027s `lookup_by_header` scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N\\u00b2) CPU in the connection process, and the table holds every entry for as long as the connection stays open.\", \"base64\": false}]}]}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-110499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-26T15:35:50.929Z\", \"dateReserved\": \"2026-10-22T09:30:02.077Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-10-26T13:32:38.613Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}