VULNERABILITY INTELLIGENCE

CVE-2026-110499

CVSS score8.7 HIGH

EPSS probability0.28%

CISA KEVNot currently listed

Published2026-10-26

Last modified2026-10-26

Description

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whate…