CVE-2026-109584

CVE-2026-109584 · HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

CVSS 8.7 · Hoch · EPSS 0,6% · Korrektur verfügbar

Veröffentlicht

2026-10-26T13:32:22.359Z

Aktualisiert

2026-10-26T15:35:51.081Z

Technologie-Stack: system

Prüfen Sie Ihren Server →