Live › vulnerability › CVE-2026-113436
Go to dashboardBandit's header integer parser handles content-length and Host port values one digit at a time with no length limit, so very long digit strings cost quadratic CPU time. An unauthenticated remote attacker can send such headers, and over HTTP/2 reuse a stored value to keep the server busy with little traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications that run Bandit as their HTTP server, over HTTP/1 or HTTP/2, from version 1.0.0-pre.7 up to but not including 1.14.0. The parser runs on raw request headers before any range check, so any Bandit-served endpoint reachable from the internet is exposed; services behind a proxy that rejects oversized headers are less exposed but the sources do not say how much a proxy would mitigate.
No product ranges from the sources yet.
mix.lock) or run mix deps | grep bandit1.14.01.14.0 or later in mix.exs and run mix deps.update banditEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.
Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.
This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-113436")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.