CVE-2026-109584highCWE-409

CVE-2026-109584: high-severity vulnerability in mtrudel bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Published

Follow this CVE+ Monitor bandit+ Monitor bandit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
mtrudel · bandit
Related CVEs — mtrudel bandit

In the same product, most dangerous first.

CVE-2026-39804HIGHWebSocket permessage-deflate inflate has no output-size cap in banditEPSS 0.8%CVE-2026-75484MEDIUMHTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in BanditEPSS 0.7%CVE-2026-42786HIGHWebSocket fragmented message reassembly unbounded in banditEPSS 0.6%CVE-2026-39803HIGHHTTP/1 chunked body reader ignores length cap in banditEPSS 0.6%CVE-2026-74836HIGHHTTP/2 connection-window starvation pins Plug processes indefinitely in BanditEPSS 0.6%CVE-2026-39806HIGHHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditEPSS 0.6%