Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Summary

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly.

The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process.

This issue affects bandit: from 0.3.6 before 1.14.0.

Details

1. Table size (lib/bandit/http2/connection.ex)

On every SETTINGS frame, Bandit.HTTP2.Connection passes the peer's SETTINGS_HEADER_TABLE_SIZE straight to HPAX.resize/2 for the encoder table, accepting values up to 2^32-1. No server-side limit is applied.

2. Indexing

encode_headers encodes every response header as :store, adding it to the dynamic table. Headers whose values differ per response (date, content-length, set-cookie, x-request-id, a reflected location) produce new entries, and with a limit of about 4 GB none are evicted.

3. Cost

HPAX's lookup_by_header scans the table linearly for each header it encodes, so every response costs more than the one before it. Serving N responses on one connection costs O(N²) CPU in the connection process, and the table holds every entry for as long as the connection stays open.

Proof of concept

1. Open an HTTP/2 connection and advertise a SETTINGS_HEADER_TABLE_SIZE of 4294967295 in the initial SETTINGS frame.
2. Send cheap requests one after another on that connection, each to an endpoint whose response carries a header value that changes per request.
3. Time the round trips. In the reporter's run, the last 1,000 of 12,000 requests took 3.68 times as long as the first 1,000.

Impact

An unauthenticated remote client that keeps an HTTP/2 connection busy with cheap requests makes every response on it progressively more expensive, because the encoder table it enlarged never shrinks. Holding several such connections open ties up server CPU and memory for as long as the attacker keeps them alive.

Workarounds

From 0.7.0, cap the requests one HTTP/2 connection may serve, for example with http_2_options: [max_requests: 1000], so each connection and its encoder table is closed before the cost grows large. Alternatively, disable HTTP/2 with http_2_options: [enabled: false].