The vulnerability arises when Bandit accepts a client‑supplied SETTINGS_HEADER_TABLE_SIZE value without imposing any server‑side limit. The HTTP/2 implementation resizes its HPACK encoder table to the advertised size, which can be as large as 2^32‑1 bytes. Because every response header is stored without eviction, the table grows with each response sent over the same connection, leading to unbounded memory consumption and a quadratic CPU cost on the connection. This resource exhaustion can cause the service to become unresponsive, satisfying the criteria for a denial‑of‑service attack (CWE‑770).

Affected products include Bandit, the HTTP/2 web server maintained by mtrudel. Versions from 0.3.6 up to, but not including, 1.14.0 are vulnerable; the issue was addressed in 1.14.0 and later releases. Any deployment using those versions and accepting HTTP/2 connections is potentially impacted.

The CVSS score of 8.7 indicates a high risk of impact. While an EPSS score is not available, the lack of authentication requirements and the ability to trigger the exploit simply by establishing an HTTP/2 connection make the attack vector straightforward. The vulnerability is not listed in CISA’s KEV catalog, but the exposed window for resource exhaustion remains significant. An attacker could send a single request with a disproportionately large SETTINGS_HEADER_TABLE_SIZE and then transmit many responses, exhausting memory and CPU, thereby denying service to legitimate users.