CVE-2026-110499

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.6 through 1.13.x

Description An unauthenticated remote attacker can cause unbounded growth of per-connection memory and CPU usage in the HTTP/2 implementation. This occurs because the software resizes its HPACK encoder table based on the SETTINGS HEADER TABLE SIZE advertised by the client without applying a server-side cap, allowing sizes up to 2^32-1 bytes. Since response headers with distinct values like date or content-length are indexed and not evicted, the table grows with every response. Consequently, the lookup by header function in the HPAX library scans the table linearly, resulting in O(N²) CPU cost for serving N responses on a single connection. The issue is located in the Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) where remote settings.header table size is passed to HPAX.resize/2, and the encode headers function encodes every response header as :store.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround for versions 0.7.0 and later, cap the number of requests a single HTTP/2 connection can serve by setting http 2 options: [max requests: 1000]. Alternatively, disable HTTP/2 by setting http 2 options: [enabled: false].