{"id":"EEF-CVE-2026-113436","summary":"Quadratic bignum parsing of Content-Length and Host port values in Bandit","details":"## Summary\n\nInefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a `content-length` value or a `Host` or `:authority` port made of thousands of digits.\n\n`Bandit.Headers.parse_integer/2` in `lib/bandit/headers.ex` builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0.\n\n## Details\n\n**1. Unbounded digit loop.** `Bandit.Headers.parse_integer/2` in `lib/bandit/headers.ex` builds the number with `total * 10 + digit - ?0` and has no limit on the digit count. Each step allocates a new bignum, so parsing one value costs O(n²). On OTP 28, 10,000 digits take about 10 ms, 50,000 about 250 ms and 80,000 about 560 ms, where `String.to_integer/1` handles the same inputs in 1 to 3 ms.\n\n**2. Reached on raw input.** It is called from `get_content_length/1` and `parse_hostlike_header!/1` on raw request input, before any range check. An all-digit `content-length` is returned as `{:ok, huge_int}`, and the `is_port_number` guard only runs after the whole number is built.\n\n**3. HPACK amplification.** Over HTTP/2, a 4,000-digit value (about 1.1 ms to parse) can be stored once in the HPACK dynamic table and then re-sent on each new stream for about one byte.\n\n## Proof of concept\n\n1. Run Bandit with any Plug.\n2. Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n3. In one write, send 5,000 HEADERS frames for `POST /` on new streams, each carrying a `content-length` of 4,000 `9` digits encoded with HPACK indexing, so that every frame after the first refers to the stored value.\n4. The 124,003 bytes take 27.9 s to process before all 5,000 requests reach the Plug.\n\n## Impact\n\nAn unauthenticated client can make the server spend CPU time out of all proportion to the traffic it sends (27.9 s for 124 KB in the reporter's test). This affects any Bandit server reachable by untrusted clients over HTTP/1 or HTTP/2, with no special configuration.","aliases":["CVE-2026-113436","GHSA-29cr-8477-rg6r"],"modified":"2026-10-26T13:56:06.731234193Z","published":"2026-10-26T13:31:35.033Z","database_specific":{"cpe_ids":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-407"],"capec_ids":["CAPEC-130"]},"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-113436.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"affected":[{"package":{"name":"bandit","ecosystem":"Hex","purl":"pkg:hex/bandit"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0-pre.7"},{"fixed":"1.14.0"}]}],"versions":["1.0.0","1.0.0-pre.10","1.0.0-pre.11","1.0.0-pre.12","1.0.0-pre.13","1.0.0-pre.14","1.0.0-pre.15","1.0.0-pre.16","1.0.0-pre.17","1.0.0-pre.18","1.0.0-pre.7","1.0.0-pre.8","1.0.0-pre.9","1.1.0","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.6.0","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.8.0","1.9.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-113436.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/mtrudel/bandit","events":[{"introduced":"e0c8c0c30af9b0f57d8aafac37ddd9294363a8be"},{"fixed":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}]}],"versions":["1.13.1","1.13.0","1.12.5","1.12.4","1.12.3","1.12.1","1.12.0","1.11.1","1.11.0","1.10.4","1.10.3","1.10.2","1.10.1","1.10.0","1.9.0","1.8.0","1.7.0","1.6.11","1.6.10","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.7","1.5.6","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0","1.4.2","1.4.1","1.4.0","1.3.0","1.2.3","1.2.0","1.1.3","1.1.2","1.1.1","1.1.0","1.0.0","1.0.0-pre.18","1.0.0-pre.17","1.0.0-pre.16","1.0.0-pre.15","1.0.0-pre.14","1.0.0-pre.13","1.0.0-pre.12","1.0.0-pre.11","1.0.0-pre.10","1.0.0-pre.9","1.0.0-pre.8","1.0.0-pre.7"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-113436.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Mat Trudel","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}