CVE-2026-113436 json
Quadratic bignum parsing of Content-Length and Host port values in Bandit
published 14d ago modified 14d ago also EEF-CVE-2026-113436 , EUVD-2026-109823 , GHSA-29cr-8477-rg6r
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits.
Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s.
This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
Patch / fix
- hex bandit 1.14.0
- mtrudel bandit 1.14.0
Is CVE-2026-113436 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14d ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | bandit | >=1.0.0-pre.7, <1.14.0 |
1.14.0 |
Affected products
- mtrudel bandit
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
References
-
github.com
/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be
related, web
-
github.com
/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
patch
-
github.com
/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r
vendor-advisory, related, advisory
-
cna.erlef.org
/cves/CVE-2026-113436.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-113436
related
-
hex.pm
/packages/bandit
package
Sources
- CVE List CVE-2026-113436
- NVD CVE-2026-113436
- OSV EEF-CVE-2026-113436
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.