Bandit EUVD-2026-109827

Requires that HTTP/2 be enabled and reachable on the Bandit server (the default; Bandit is the default Phoenix adapter) - disabling it via http_2_options: [enabled: false] removes exposure. No authentication and no user interaction are needed (PR:N/UI:N). The attacker must keep a long-lived HTTP/2 connection open and send a sustained stream of requests to an endpoint whose responses include per-request-varying header values so dynamic-table entries are never evicted; the cost is per-connection and grows quadratically only while the connection stays alive, so impact scales with how long connections remain open and how many the attacker holds. The limiting factors are that this is purely an availability/resource-exhaustion issue (no data disclosure or modification) and that the fixed configuration option http_2_options: [max_requests: N] (from 0.7.0) or upgrading to 1.14.0 caps or prevents the growth.

This is a genuine but bounded availability risk, best read as a priority rather than an emergency. All impact signals point in one direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated triggering with no user interaction, but impact is confined to availability (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - consistent with the CWE-770 resource-exhaustion/DoS classification and the 'Denial Of Service' tag. There is no KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from these sources; treat the absence as unknown, not as evidence of safety. The vuln.today decision label is 'this_week', which aligns with a patch-available DoS that is easy to trigger but not known to be actively exploited. A public PoC methodology is described in the GHSA advisory (open connection, advertise SETTINGS_HEADER_TABLE_SIZE of 4294967295, send cheap requests with per-response-varying headers), but the input does not mark it as confirmed working exploit code. Net: a real, prioritizable DoS against HTTP/2-enabled Bandit deployments, not a high-CVSS-but-low-real-risk paper issue, yet lacking the active-exploitation evidence that would make it an emergency.

An unauthenticated remote attacker opens an HTTP/2 connection to a Bandit server and advertises a maximal SETTINGS_HEADER_TABLE_SIZE (up to 2^32-1). It then streams many cheap requests to an endpoint whose responses carry per-request-varying header values (date, content-length, set-cookie, x-request-id), so Bandit's HPACK encoder table grows without eviction and every response costs more than the last (O(N²) CPU per connection). A public PoC reference exists describing exactly this; it is not verified as working exploit code in the supplied data.