{"id":"CVE-2026-113436","kind":"vulnerability","aliases":["CVE-2026-113436"],"related":[],"title":"Bandit: header integer parsing lets remote requests consume server CPU","description":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.\n\nBandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0.","summary":"Bandit's header integer parser handles content-length and Host port values one digit at a time with no length limit, so very long digit strings cost quadratic CPU time. An unauthenticated remote attacker can send such headers, and over HTTP/2 reuse a stored value to keep the server busy with little traffic.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","http-server","package","phoenix","self-hosted"],"not_affected_if":["bandit-1.14.0-or-later","not-using-bandit"],"how_to_check":"- Check the bandit version in the project's lockfile (`mix.lock`) or run `mix deps | grep bandit`\n- Confirm the lockfile resolves bandit below `1.14.0`","fix":"- Upgrade bandit to `1.14.0` or later in `mix.exs` and run `mix deps.update bandit`\n- Redeploy the application after the upgrade","status":"open","published_at":"2026-10-26T14:16:28+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:08+00:00","updated_at":"2026-10-26T14:32:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T14:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bandit to `1.14.0` or later in `mix.exs` and run `mix deps.update bandit`\n- Redeploy the application after the upgrade","reach":"internet","title":"Bandit: header integer parsing lets remote requests consume server CPU","impact":"medium","summary":"Bandit's header integer parser handles content-length and Host port values one digit at a time with no length limit, so very long digit strings cost quadratic CPU time. An unauthenticated remote attacker can send such headers, and over HTTP/2 reuse a stored value to keep the server busy with little traffic.","category":"package","nicknames":[],"who_cares":["elixir","phoenix","bandit","self-hosted","http-server"],"confidence":0.8,"needs_auth":"no","worst_case":"Server CPU is exhausted by crafted headers, causing denial of service.","analyst_note":"","how_to_check":"- Check the bandit version in the project's lockfile (`mix.lock`) or run `mix deps | grep bandit`\n- Confirm the lockfile resolves bandit below `1.14.0`","needs_analyst":false,"not_affected_if":["bandit-1.14.0-or-later","not-using-bandit"],"who_is_affected":"Applications that run Bandit as their HTTP server, over HTTP/1 or HTTP/2, from version 1.0.0-pre.7 up to but not including 1.14.0. The parser runs on raw request headers before any range check, so any Bandit-served endpoint reachable from the internet is exposed; services behind a proxy that rejects oversized headers are less exposed but the sources do not say how much a proxy would mitigate.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000654,"input_tokens":3510,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113436':13A,16A '-2026':12A,15A '000':172C '1.0.0':212C '1.14.0':215C '124':196C '27.9':205C '4':171C 'affect':209C 'algorithm':82C 'alloc':138C 'allow':93C 'attack':61B,97C 'author':112C 'bandit':1A,17B,27B,92C,210C 'bandit.headers.parse':119C 'bignum':141C 'build':123C 'busi':77B,203C 'byte':195C 'check':167C 'complex':83C 'consum':8A,99C 'content':34B,105C 'content-length':33B,104C 'cost':54B,148C 'count':137C 'cpu':10A,56B,101C 'cve':11A,14A 'digit':41B,52B,118C,127C,136C,173C 'dynam':182C 'elixir':18B 'handl':32B 'header':2A,29B,65B,87C 'host':26B,37B,110C 'hpack':181C 'http':20B 'http-server':19B 'http/1':161C 'http/2':68B,163C,169C 'ineffici':81C 'input':159C 'integ':3A,30B,88C 'integer/2':120C 'issu':208C 'kb':197C 'keep':74B 'kept':200C 'length':35B,47B,106C,153C 'let':5A 'lib/bandit/headers.ex':122C 'limit':48B,133C 'littl':79B 'long':51B 'made':114C 'mtrudel':91C 'new':140C,190C 'number':125C 'one':40B,126C,146C,194C 'packag':22B 'pars':4A 'parser':31B,89C 'phoenix':23B 'port':38B,113C 'pre.7':213C 'quadrat':55B,150C 'rang':166C 'raw':157C 're':186C 're-sent':185C 'remot':6A,60B,96C 'request':7A,158C 'reus':69B 'run':155C 'self':25B 'self-host':24B 'send':63B 'sent':187C 'server':9A,21B,76B,100C,202C 'step':144C 'store':71B,177C 'stream':191C 'string':53B 'tabl':183C 'thousand':116C 'time':44B,57B,130C,149C 'traffic':80B,199C 'unauthent':59B,95C 'valu':39B,72B,107C,147C,174C 'via':102C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Bandit as their HTTP server, over HTTP/1 or HTTP/2, from version 1.0.0-pre.7 up to but not including 1.14.0. The parser runs on raw request headers before any range check, so any Bandit-served endpoint reachable from the internet is exposed; services behind a proxy that rejects oversized headers are less exposed but the sources do not say how much a proxy would mitigate.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113436","severity":null,"published_at":"2026-10-26T14:16:28+00:00","modified_at":"2026-10-26T14:16:28+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}