Bandit CVE-2026-113436

No special conditions - remote unauthenticated exploitation against default configurations of the Bandit web server (Elixir/Erlang). The flaw is reached on raw request input before any range check, via a content-length value or a Host/:authority port made of thousands of digits, on both HTTP/1 and HTTP/2. The only prerequisite is running a vulnerable version (1.0.0-pre.7 up to before 1.14.0) reachable by untrusted clients. Limiting factors: the severe amplification (one stored value replayed cheaply across many streams) specifically requires HTTP/2 with HPACK dynamic-table indexing enabled, though HTTP/1 is still vulnerable at lower leverage; and servers already upgraded to 1.14.0 are not affected. There is no authentication, user interaction, or non-default setting required to trigger the parser.

This is a genuine, actionable availability risk rather than an inflated high score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 and is consistent with the mechanism: a remote, unauthenticated attacker over the network, no user interaction, no special configuration. Impact is availability-only (VA:H; VC:N/VI:N - no confidentiality or integrity exposure), so this is a denial-of-service, not a data-exposure or RCE issue. The strongest risk signal is the amplification demonstrated by the reporter: 124 KB of HTTP/2 traffic kept the server busy for 27.9 s because a single 4,000-digit value is stored once in the HPACK dynamic table and replayed across 5,000 streams, each costing quadratic parse time. CWE-407 and the source diff confirm the O(n²) bignum loop. KEV status is not listed (no confirmed active exploitation), and no EPSS score was provided, so widespread exploitation cannot be quantified from the input - the absence of EPSS/KEV data should be noted rather than read as low risk. A detailed PoC methodology is published in the GHSA advisory, but the input does not confirm a standalone working exploit. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-non-emergency availability bug: prioritize patching this week for any internet-facing Bandit server.

An attacker opens an HTTP/2 connection to any internet-facing Bandit server, sends a Content-Length (or Host/:authority port) value of several thousand digits stored once in the HPACK dynamic table, and re-references it across thousands of new streams. The server spends CPU time wildly out of proportion to the tiny traffic volume (27.9 s for ~124 KB in the reporter's test), degrading or denying service. A public PoC reference with step-by-step methodology exists in the GHSA advisory; it is not verified as working exploit code, and no authentication or special configuration is required.