CVE-2026-113436 in bandit
Summary
by MITRE • 10/26/2026
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.
Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.
This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Bandit, specifically within the header integer parser located at lib/bandit/headers.ex under the function parse_integer/2, represents a classic inefficient algorithmic complexity flaw that enables denial of service attacks through resource exhaustion. This issue arises because the implementation constructs numeric values digit by digit without imposing any limit on the number of digits allowed in HTTP headers such as Content-Length or Host and :authority fields during HTTP/1 and HTTP/2 communications. The parser allocates a new bignum at each step, resulting in computational time that scales quadratically with respect to the length of the input string rather than linearly. This design oversight allows an unauthenticated remote attacker to trigger significant CPU consumption by submitting header values containing thousands of digits, effectively overwhelming the server's processing capabilities before any range checks or validation logic can intervene.
The operational impact of this vulnerability is severe due to its efficiency in resource exhaustion attacks. In HTTP/1 environments, sending a single request with an excessively long numeric header value forces the server to perform extensive arithmetic operations for each digit processed. However, the risk escalates dramatically under HTTP/2 protocols where HPACK compression and dynamic table mechanisms are utilized. An attacker can store a large integer once in the HPACK dynamic table and then reference it on every subsequent stream with minimal overhead, approximately one byte per request. This capability allows an adversary to maintain persistent server load using relatively low bandwidth; for instance, transmitting only 124 KB of traffic was sufficient to keep a server busy for nearly twenty-eight seconds. Such behavior demonstrates how the vulnerability can be leveraged to create sustained denial-of-service conditions that degrade service availability without requiring high-volume network flooding.
From a classification perspective, this flaw aligns with CWE-756: Missing or Incorrect Explanation of Operational Understanding regarding algorithmic complexity and CWE-400: Uncontrolled Resource Consumption. It also maps directly to the MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under resource exhaustion subcategories where attackers target computational resources rather than memory or disk space. The vulnerability affects Bandit versions from 1.0.0-pre.7 up to but not including version 1.14.0, indicating that earlier releases are particularly susceptible due to the absence of safeguards against excessively large integer inputs in header parsing routines.
Mitigation strategies must focus on enforcing strict limits on input size and optimizing algorithmic efficiency within the parser logic. Developers should implement a maximum length constraint for all numeric headers processed by Bandit, ensuring that any value exceeding a reasonable threshold is immediately rejected before arithmetic operations begin. Additionally, switching to linear-time integer parsing algorithms or using built-in language features with bounded capacity can prevent quadratic scaling issues. For organizations unable to patch immediately, deploying Web Application Firewalls configured to truncate or reject HTTP headers containing abnormally long numeric sequences provides an effective compensating control. Regular auditing of third-party dependencies and ensuring timely updates to Bandit are essential for maintaining resilience against this class of algorithmic complexity vulnerabilities in high-traffic web environments.