CVE-2026-113436highCWE-407

CVE-2026-113436: falha de alta gravidade em mtrudel bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

Publicada em

Seguir esta CVE+ Monitorar bandit+ Monitorar bandit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s. This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
mtrudel · bandit
CVEs relacionadas — mtrudel bandit

No mesmo produto, das mais perigosas para as menos.

CVE-2026-39804HIGHWebSocket permessage-deflate inflate has no output-size cap in banditEPSS 0.8%CVE-2026-75484MEDIUMHTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in BanditEPSS 0.7%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2026-74836HIGHHTTP/2 connection-window starvation pins Plug processes indefinitely in BanditEPSS 0.6%CVE-2026-39806HIGHHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditEPSS 0.6%