{"id":"EEF-CVE-2026-110499","summary":"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit","details":"## Summary\n\nAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large `SETTINGS_HEADER_TABLE_SIZE`. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as `date` or `content-length`, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.\n\nThe SETTINGS handling in `Bandit.HTTP2.Connection` (`lib/bandit/http2/connection.ex`) passes `remote_settings.header_table_size` to `HPAX.resize/2` with no server-side cap, and `encode_headers` encodes every response header as `:store`. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.\n\nThis issue affects bandit: from 0.3.6 before 1.14.0.\n\n## Details\n\n**1. Table size** (`lib/bandit/http2/connection.ex`)\n\nOn every SETTINGS frame, `Bandit.HTTP2.Connection` passes the peer's `SETTINGS_HEADER_TABLE_SIZE` straight to `HPAX.resize/2` for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.\n\n**2. Indexing**\n\n`encode_headers` encodes every response header as `:store`, adding it to the dynamic table. Headers whose values differ per response (`date`, `content-length`, `set-cookie`, `x-request-id`, a reflected `location`) produce new entries, and with a limit of about 4 GB none are evicted.\n\n**3. Cost**\n\nHPAX's `lookup_by_header` scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N²) CPU in the connection process, and the table holds every entry for as long as the connection stays open.\n\n## Proof of concept\n\n1. Open an HTTP/2 connection and advertise a `SETTINGS_HEADER_TABLE_SIZE` of 4294967295 in the initial SETTINGS frame.\n2. Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.\n3. Time the round trips. In the reporter's run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.\n\n## Impact\n\nAn unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.\n\n## Workarounds\n\nFrom 0.7.0, cap the requests one HTTP/2 connection may serve, for example with `http_2_options: [max_requests: 1000]`, so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with `http_2_options: [enabled: false]`.","aliases":["CVE-2026-110499","GHSA-47x4-3fxf-82fr"],"modified":"2026-10-26T13:56:06.545251411Z","published":"2026-10-26T13:32:38.613Z","database_specific":{"cpe_ids":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-770"],"capec_ids":["CAPEC-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-110499.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"affected":[{"package":{"name":"bandit","ecosystem":"Hex","purl":"pkg:hex/bandit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.6"},{"fixed":"1.14.0"}]}],"versions":["0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.10","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","1.0.0","1.0.0-pre.1","1.0.0-pre.10","1.0.0-pre.11","1.0.0-pre.12","1.0.0-pre.13","1.0.0-pre.14","1.0.0-pre.15","1.0.0-pre.16","1.0.0-pre.17","1.0.0-pre.18","1.0.0-pre.2","1.0.0-pre.3","1.0.0-pre.4","1.0.0-pre.5","1.0.0-pre.6","1.0.0-pre.7","1.0.0-pre.8","1.0.0-pre.9","1.1.0","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.0","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.8.0","1.9.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-110499.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/mtrudel/bandit","events":[{"introduced":"0e68313fab9d204257ebad5c447e4cd9cea8e0ea"},{"fixed":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}]}],"versions":["1.13.1","1.13.0","1.12.5","1.12.4","1.12.3","1.12.1","1.12.0","1.11.1","1.11.0","1.10.4","1.10.3","1.10.2","1.10.1","1.10.0","1.9.0","1.8.0","1.7.0","1.6.11","1.6.10","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.7","1.5.6","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0","1.4.2","1.4.1","1.4.0","1.3.0","1.2.3","1.2.0","1.1.3","1.1.2","1.1.1","1.1.0","1.0.0","1.0.0-pre.18","1.0.0-pre.17","1.0.0-pre.16","1.0.0-pre.15","1.0.0-pre.14","1.0.0-pre.13","1.0.0-pre.12","1.0.0-pre.11","1.0.0-pre.10","1.0.0-pre.9","1.0.0-pre.8","1.0.0-pre.7","1.0.0-pre.6","1.0.0-pre.5","1.0.0-pre.4","1.0.0-pre.3","1.0.0-pre.2","1.0.0-pre.1","0.7.7","0.7.6","0.7.5","0.7.4","0.7.3","0.7.2","0.7.1","0.7.0","0.6.11","0.6.10","0.6.9","0.6.8","0.6.7","0.6.6","0.6.5","0.6.4","0.6.3","0.6.2","0.6.1","0.6.0","0.5.11","0.5.10","0.5.9","0.5.8","0.5.7","0.5.6","0.5.5","0.5.4","0.5.3","0.5.2","0.5.1","0.5.0","0.4.10","0.4.9","0.4.8","0.4.7","0.4.6","0.4.5","0.4.4","0.4.3","0.4.2","0.4.1","0.4.0","0.3.9","0.3.8","0.3.7","0.3.6"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-110499.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Mat Trudel","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}