{"id":"CVE-2026-113436","state":"PUBLISHED","title":"Quadratic bignum parsing of Content-Length and Host port values in Bandit","description":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.\n\nBandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0.","publishedAt":"2026-10-26T13:31:35.033Z","updatedAt":"2026-10-26T15:35:51.556Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"EEF"},"assigner":"EEF","products":["mtrudel bandit"],"affected":[{"vendor":"mtrudel","product":"bandit","packageName":"bandit","packageURL":"pkg:hex/bandit","defaultStatus":"unaffected","versions":[{"version":"1.0.0-pre.7","status":"affected","lessThan":"1.14.0","versionType":"semver"}],"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"repo":"https://github.com/mtrudel/bandit"},{"vendor":"mtrudel","product":"bandit","packageName":"mtrudel/bandit","packageURL":"pkg:github/mtrudel/bandit","defaultStatus":"unaffected","versions":[{"version":"e0c8c0c30af9b0f57d8aafac37ddd9294363a8be","status":"affected","lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","versionType":"git"}],"collectionURL":"https://github.com","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"repo":"https://github.com/mtrudel/bandit"}],"references":["https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r","https://cna.erlef.org/cves/CVE-2026-113436.html","https://osv.dev/vulnerability/EEF-CVE-2026-113436","https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be","https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"],"weaknesses":["CWE-407"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/113xxx/CVE-2026-113436.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-113436","state":"PUBLISHED","datePublished":"2026-10-26T13:31:35.033Z","dateUpdated":"2026-10-26T15:35:51.556Z","assignerShortName":"EEF","assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","dateReserved":"2026-10-23T10:30:01.881Z"},"containers":{"cna":{"title":"Quadratic bignum parsing of Content-Length and Host port values in Bandit","descriptions":[{"lang":"en","value":"Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.\n\nBandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.\n\nThis issue affects bandit: from 1.0.0-pre.7 before 1.14.0."}],"affected":[{"vendor":"mtrudel","product":"bandit","packageName":"bandit","packageURL":"pkg:hex/bandit","defaultStatus":"unaffected","versions":[{"version":"1.0.0-pre.7","status":"affected","lessThan":"1.14.0","versionType":"semver"}],"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"repo":"https://github.com/mtrudel/bandit"},{"vendor":"mtrudel","product":"bandit","packageName":"mtrudel/bandit","packageURL":"pkg:github/mtrudel/bandit","defaultStatus":"unaffected","versions":[{"version":"e0c8c0c30af9b0f57d8aafac37ddd9294363a8be","status":"affected","lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","versionType":"git"}],"collectionURL":"https://github.com","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"repo":"https://github.com/mtrudel/bandit"}],"references":[{"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r","name":"Quadratic bignum parsing of Content-Length and Host port values in Bandit","tags":["vendor-advisory","related"]},{"url":"https://cna.erlef.org/cves/CVE-2026-113436.html","name":"EEF CNA record for CVE-2026-113436","tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-113436","name":"OSV record EEF-CVE-2026-113436","tags":["related"]},{"url":"https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be","name":"Introducing commit e0c8c0c in mtrudel/bandit","tags":["related"]},{"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a","name":"Fix commit 220b9df in mtrudel/bandit","tags":["patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"EEF","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","dateUpdated":"2026-10-26T13:31:35.033Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"1.0.0-pre.7","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"reporter","value":"Peter Ullrich"},{"lang":"en","type":"remediation developer","value":"Mat Trudel"},{"lang":"en","type":"analyst","value":"Jonatan Männchen / EEF"}],"dateAssigned":"2026-10-23T12:44:41.000Z","impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

An unauthenticated client can make the server spend CPU time out of all proportion to the traffic it sends (27.9 s for 124 KB in the reporter's test). This affects any Bandit server reachable by untrusted clients over HTTP/1 or HTTP/2, with no special configuration.

"},{"base64":false,"type":"text/markdown","value":"An unauthenticated client can make the server spend CPU time out of all proportion to the traffic it sends (27.9 s for 124 KB in the reporter's test). This affects any Bandit server reachable by untrusted clients over HTTP/1 or HTTP/2, with no special configuration."}],"value":"An unauthenticated client can make the server spend CPU time out of all proportion to the traffic it sends (27.9 s for 124 KB in the reporter's test). This affects any Bandit server reachable by untrusted clients over HTTP/1 or HTTP/2, with no special configuration."}]}],"source":{"discovery":"UNKNOWN"},"x_proofOfConcept":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
    \n
  1. Run Bandit with any Plug.
    2. \n
  2. Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.
    3. \n
  3. In one write, send 5,000 HEADERS frames for POST / on new streams, each carrying a content-length of 4,000 9 digits encoded with HPACK indexing, so that every frame after the first refers to the stored value.
    4. \n
  4. The 124,003 bytes take 27.9 s to process before all 5,000 requests reach the Plug.
    5. \n
"},{"base64":false,"type":"text/markdown","value":"1. Run Bandit with any Plug.\n2. Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n3. In one write, send 5,000 HEADERS frames for `POST /` on new streams, each carrying a `content-length` of 4,000 `9` digits encoded with HPACK indexing, so that every frame after the first refers to the stored value.\n4. The 124,003 bytes take 27.9 s to process before all 5,000 requests reach the Plug."}],"value":"* Run Bandit with any Plug.\n* Open an HTTP/2 connection with prior knowledge and complete the SETTINGS exchange.\n* In one write, send 5,000 HEADERS frames for POST / on new streams, each carrying a content-length of 4,000 9 digits encoded with HPACK indexing, so that every frame after the first refers to the stored value.\n* The 124,003 bytes take 27.9 s to process before all 5,000 requests reach the Plug."}],"x_technicalAnalysis":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

1. Unbounded digit loop. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number with total * 10 + digit - ?0 and has no limit on the digit count. Each step allocates a new bignum, so parsing one value costs O(n²). On OTP 28, 10,000 digits take about 10 ms, 50,000 about 250 ms and 80,000 about 560 ms, where String.to_integer/1 handles the same inputs in 1 to 3 ms.

\n

2. Reached on raw input. It is called from get_content_length/1 and parse_hostlike_header!/1 on raw request input, before any range check. An all-digit content-length is returned as {:ok, huge_int}, and the is_port_number guard only runs after the whole number is built.

\n

3. HPACK amplification. Over HTTP/2, a 4,000-digit value (about 1.1 ms to parse) can be stored once in the HPACK dynamic table and then re-sent on each new stream for about one byte.

"},{"base64":false,"type":"text/markdown","value":"**1. Unbounded digit loop.** `Bandit.Headers.parse_integer/2` in `lib/bandit/headers.ex` builds the number with `total * 10 + digit - ?0` and has no limit on the digit count. Each step allocates a new bignum, so parsing one value costs O(n²). On OTP 28, 10,000 digits take about 10 ms, 50,000 about 250 ms and 80,000 about 560 ms, where `String.to_integer/1` handles the same inputs in 1 to 3 ms.\n\n**2. Reached on raw input.** It is called from `get_content_length/1` and `parse_hostlike_header!/1` on raw request input, before any range check. An all-digit `content-length` is returned as `{:ok, huge_int}`, and the `is_port_number` guard only runs after the whole number is built.\n\n**3. HPACK amplification.** Over HTTP/2, a 4,000-digit value (about 1.1 ms to parse) can be stored once in the HPACK dynamic table and then re-sent on each new stream for about one byte."}],"value":"1. Unbounded digit loop. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number with total * 10 + digit - ?0 and has no limit on the digit count. Each step allocates a new bignum, so parsing one value costs O(n²). On OTP 28, 10,000 digits take about 10 ms, 50,000 about 250 ms and 80,000 about 560 ms, where String.to_integer/1 handles the same inputs in 1 to 3 ms.\n\n2. Reached on raw input. It is called from get_content_length/1 and parse_hostlike_header!/1 on raw request input, before any range check. An all-digit content-length is returned as {:ok, huge_int}, and the is_port_number guard only runs after the whole number is built.\n\n3. HPACK amplification. Over HTTP/2, a 4,000-digit value (about 1.1 ms to parse) can be stored once in the HPACK dynamic table and then re-sent on each new stream for about one byte."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-113436","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-26T15:12:04.626946Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-26T15:35:51.556Z"}}]}}}