CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-110499?
CVE-2026-110499 is a high-severity vulnerability in mtrudel bandit, published on 26 Oct 2026.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.
The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.
This issue affects bandit: from 0.3.6 before 1.14.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-110499?
1 open source package ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 0.3.6 | 1.14.0 |
How do I fix CVE-2026-110499?
Upgrade bandit to 1.14.0 or later.
Is CVE-2026-110499 being exploited?
There is no known exploitation of CVE-2026-110499 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-110499, GHSA-47x4-3fxf-82fr, UBUNTU-CVE-2026-110499.