Bandit

Mtrudel Bandit: Uncontrolled Resource Consumption

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Mtrudel Bandit: Allocation of Resources Without Limits or Throttling

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Mtrudel Bandit: Allocation of Resources Without Limits or Throttling

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

WebSocket permessage-deflate inflate has no output-size cap in bandit

HTTP/1 chunked body reader ignores length cap in bandit

Mtrudel Bandit: CRLF Injection

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

WebSocket fragmented message reassembly unbounded in bandit

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

HTTP/2 frame size limit checked after body is buffered in bandit

Client-supplied URI scheme trusted without transport verification in bandit