CVE-2026-113436
Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Bandit HTTP Server

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s. This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-113436
EUVD
EUVD-2026-109823

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 1.0.0-pre.7
mtrudel bandit e0c8c0c30af9b0f57d8aafac37ddd9294363a8be

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an inefficient algorithmic complexity issue in the header integer parser of the Bandit web server. It allows an unauthenticated remote attacker to consume excessive server CPU by sending a content-length value or a Host/:authority port with thousands of digits. The parser builds numbers one digit at a time without digit limits, causing quadratic time complexity and repeated memory allocations.

Detection Guidance

Detect this vulnerability by monitoring for unusually high CPU usage on your web server when handling HTTP requests with extremely long header values like content-length or Host/:authority ports. Check for requests with thousands of digits in these fields.

Impact Analysis

This vulnerability can cause severe performance degradation or denial of service on affected Bandit servers. Attackers can send specially crafted requests with very long digit sequences, consuming CPU resources and potentially making the server unresponsive. Over HTTP/2, a single large value can be reused across multiple requests with minimal traffic overhead.

Mitigation Strategies

Upgrade bandit to version 1.14.0 or later to fix the inefficient header parsing. If immediate upgrade is not possible, implement rate limiting or request size limits on your web server to block excessively large headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart