EUVD-2026-109837

Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds...

CVE-2026-97200

Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds...

EEF-CVE-2026-97200 Unbounded response body buffering and decompression in hackney

Summary Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothin...

CVE-2026-97200

The benoitc hackney library (versions 2.0.0-beta.1 to 4.8.4 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-409, CWE-770) flaw in the hackney_conn component. The issue stems from unbounded accumulation in hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accu...

CVE-2026-108529

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

CVE-2026-108529

The mtrudel bandit web server (versions 0.3.4 before 1.14.0 ) is vulnerable to an Inefficient Algorithmic Complexity vulnerability in its HTTP/2 implementation. An unauthenticated remote attacker can exhaust server CPU by opening thousands of streams that block on the connection send window. By s...

EUVD-2026-109829

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

EEF-CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Summary Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the...

CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

EUVD-2026-109827

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

CVE-2026-110499

The mtrudel bandit web server (versions 0.3.6 before 1.14.0) is vulnerable to a CWE-770 Resource Exhaustion vulnerability in its HTTP/2 implementation . An unauthenticated remote attacker can cause unbounded memory and CPU growth by advertising a large SETTINGS_HEADER_TABLE_SIZE (up to 2^32-1 byt...

CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

CVE-2026-110499

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

EEF-CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table ...

CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic...

CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic...