CVE-2026-113436

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Published Oct 26, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.

Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.

This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.

Analysis

Technical impact

Bandit parses header integers one digit at a time, allocating a new big number each step. This quadratic time growth allows a single header value composed of thousands of digits to consume a disproportionate amount of CPU. An attacker can trigger this by sending a crafted Content‑Length or Host/Authority port header, resulting in sustained CPU load and eventual service degradation or unavailability.

Affected Systems

The vulnerability affects the Bandit web server produced by mtrudel for the product Bandit. All releases from version 1.0.0‑pre.7 up through, but not including, 1.14.0 are impacted. Updating to Bandit 1.14.0 or newer removes the flaw.

Risk and Exploitability

With a CVSS score of 8.7 the weakness is considered high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. An unauthenticated remote attacker can execute the attack simply by sending a malicious HTTP/1 or HTTP/2 request; no additional privileges are required. The large numeric value is parsed before any validation, so the server is forced to perform the expensive operation before it can reject the request.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mtrudel

bandit

unaffected

Version	Status	Constraints
`1.0.0-pre.7`	affected	< 1.14.0

mtrudel

bandit

unaffected

Version	Status	Constraints
`e0c8c0c30af9b0f57d8aafac37ddd9294363a8be`	affected	< 220b9dfd27f9a21305be2afc75cbe585ddc24e7a

No data.

Vendor Product Versions

Mtrudel

Bandit

Version	Status	Scheme	Platform
`[1.0.0-pre.7,1.14.0)`	affected	semver	—

Mtrudel

Bandit

Version	Status	Scheme	Platform
`[e0c8c0c30af9b0f57d8aafac37ddd9294363a8be,220b9dfd27f9a21305be2afc75cbe585ddc24e7a)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Bandit to version 1.14.0 or later, which removes the quadratic parsing bug.
If an upgrade is not possible, deploy a reverse proxy that blocks or rate‑limits HTTP requests with Content‑Length or Host/Authority header values longer than a reasonable maximum (e.g., 12 digits) before they reach Bandit.
As a temporary measure, disable HTTP/2 support or configure a limiter that drops or rejects connections with excessively large header values until the patch can be applied.

Generated by OpenCVE AI on October 26, 2026 at 15:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.602% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-113436.html
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be
https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r
https://osv.dev/vulnerability/EEF-CVE-2026-113436

History

Oct 26, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 2:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s. This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
Title		Quadratic bignum parsing of Content-Length and Host port values in Bandit
First Time appeared		Mtrudel Mtrudel bandit
Weaknesses		CWE-407
CPEs		cpe:2.3:a:mtrudel:bandit::::::::
Vendors & Products		Mtrudel Mtrudel bandit
References		https://cna.erlef.org/cves/CVE-2026-113436.html https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r https://osv.dev/vulnerability/EEF-CVE-2026-113436
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`