CVE-2026-113436

Name of the Vulnerable Software and Affected Versions bandit versions 1.0.0-pre.7 through 1.13.x

Description An unauthenticated remote attacker can cause excessive server CPU consumption due to inefficient algorithmic complexity in the header integer parser. The function Bandit.Headers.parse integer/2 in lib/bandit/headers.ex processes numbers one digit at a time without a limit on the digit count, allocating a new bignum at each step. This results in processing time that is quadratic relative to the length of the input. The issue is triggered by providing a content-length value or a Host or :authority port consisting of thousands of digits. This occurs on raw request input over HTTP/1 and HTTP/2 before any range checks are performed. In HTTP/2 environments, an attacker can use HPACK dynamic table storage to amplify the effect, sending a large value once and referencing it in subsequent streams to keep the server busy with minimal traffic.

Recommendations Update bandit to version 1.14.0 or later.