CVE-2026-110499 - Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
CVE ID :CVE-2026-110499 Published : Oct. 26, 2026, 1:32 p.m. | 50 minutes ago Description :Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost...