Live › vulnerability › CVE-2026-110499
Go to dashboardBandit, an Elixir HTTP server, resizes its HPACK header table to whatever size a client requests in SETTINGS, up to about 4 GB, and never evicts entries. An unauthenticated remote client can make each connection consume unbounded memory and CPU, slowing or exhausting the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Elixir applications that serve HTTP/2 directly with Bandit from versions 0.3.6 up to but not including 1.14.0. Applications that serve only HTTP/1.1, or that terminate HTTP/2 at a proxy that does not pass it through to Bandit, are not exposed to this path.
No product ranges from the sources yet.
mix.lock or mix deps output and confirm whether it is below 1.14.0http_2 or :http_2 options in the endpoint configurationbandit dependency to 1.14.0 or later and redeployEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.
The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.
This issue affects bandit: from 0.3.6 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-110499")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.