CVE-2026-110499
Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits in Bandit HTTP/2

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly. The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process. This issue affects bandit: from 0.3.6 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-110499
EUVD
EUVD-2026-109827

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.3.6
mtrudel bandit 0e68313fab9d204257ebad5c447e4cd9cea8e0ea

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110499 is an Allocation of Resources Without Limits vulnerability in the HTTP/2 implementation of the Bandit server. It allows an unauthenticated remote attacker to cause unbounded memory and CPU growth on the server by setting an extremely large HPACK encoder table size via the SETTINGS_HEADER_TABLE_SIZE parameter. The server resizes its HPACK table to the client's requested size without any upper limit, and since response headers like date or content-length vary per response, they are never evicted. This causes the table to grow indefinitely, leading to O(N²) CPU cost for serving N responses on a single connection.

The vulnerability affects Bandit versions from 0.3.6 to before 1.14.0. Attackers can exploit it by keeping an HTTP/2 connection open with minimal requests, progressively consuming more server resources until the system becomes unresponsive or crashes.

Detection Guidance

Monitor HTTP/2 connections for unusually high memory or CPU usage on the Bandit server process. Check for connections with abnormally large HPACK encoder tables by inspecting Bandit logs or Erlang VM metrics. Use network traffic analysis tools like Wireshark to detect clients sending large SETTINGS_HEADER_TABLE_SIZE values.

Impact Analysis

This vulnerability can lead to severe performance degradation or a complete denial of service on the affected server. As the HPACK table grows with every response, the server's CPU usage increases quadratically, consuming excessive resources. This may cause the server to slow down, become unresponsive, or crash entirely, disrupting services for legitimate users.

Attackers can exploit this by sending a few requests with large SETTINGS_HEADER_TABLE_SIZE values and keeping the connection open, gradually exhausting server resources. The impact is most severe on servers handling many concurrent HTTP/2 connections.

Mitigation Strategies

Upgrade Bandit to version 1.14.0 or later. Alternatively, limit requests per connection or disable HTTP/2 temporarily until patching. Monitor server resources closely for signs of exploitation during the interim.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart