Description
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.

Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.

This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
Published: 2026-10-26
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Denial of Service via excessive CPU consumption
Action: Immediate Patch
AI Analysis

Impact

Bandit parses header integers one digit at a time, allocating a new big number each step. This quadratic time growth allows a single header value composed of thousands of digits to consume a disproportionate amount of CPU. An attacker can trigger this by sending a crafted Content‑Length or Host/​Authority port header, resulting in sustained CPU load and eventual service degradation or unavailability.

Affected Systems

The vulnerability affects the Bandit web server produced by mtrudel for the product Bandit. All releases from version 1.0.0‑pre.7 up through, but not including, 1.14.0 are impacted. Updating to Bandit 1.14.0 or newer removes the flaw.

Risk and Exploitability

With a CVSS score of 8.7 the weakness is considered high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. An unauthenticated remote attacker can execute the attack simply by sending a malicious HTTP/1 or HTTP/2 request; no additional privileges are required. The large numeric value is parsed before any validation, so the server is forced to perform the expensive operation before it can reject the request.

Generated by OpenCVE AI on October 26, 2026 at 15:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Bandit to version 1.14.0 or later, which removes the quadratic parsing bug.
  • If an upgrade is not possible, deploy a reverse proxy that blocks or rate‑limits HTTP requests with Content‑Length or Host/Authority header values longer than a reasonable maximum (e.g., 12 digits) before they reach Bandit.
  • As a temporary measure, disable HTTP/2 support or configure a limiter that drops or rejects connections with excessively large header values until the patch can be applied.

Generated by OpenCVE AI on October 26, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s. This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
Title Quadratic bignum parsing of Content-Length and Host port values in Bandit
First Time appeared Mtrudel
Mtrudel bandit
Weaknesses CWE-407
CPEs cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
Vendors & Products Mtrudel
Mtrudel bandit
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mtrudel Bandit
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-26T15:35:51.556Z

Reserved: 2026-10-23T10:30:01.881Z

Link: CVE-2026-113436

cve-icon Vulnrichment

Updated: 2026-10-26T15:32:51.911Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T14:16:28.680

Modified: 2026-10-26T16:59:16.113

Link: CVE-2026-113436

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:15:14Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity