p PatchFirst

CVE-2026-109584

CVE-2026-109584 · HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • bandit

    Versions
    • ≥ 0.3.3, < 1.14.0: Affected (semver)

    Update to 1.14.0

  • bandit

    Versions
    • ≥ 44bf969cd59851622fb6ee4d16227fbc39a77fb4, < 220b9dfd27f9a21305be2afc75cbe585ddc24e7a: Affected (git)

    No fix published

  • bandit Ubuntu:16.04:LTS

    Versions
    • 0.13.2-1
    • 0.13.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:18.04:LTS

    Versions
    • 1.4.0-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:20.04:LTS

    Versions
    • 1.5.1-3
    • 1.6.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:22.04:LTS

    Versions
    • 1.6.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:24.04:LTS

    Versions
    • 1.6.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:26.10

    Versions
    • 1.7.10-3
    • 1.9.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bandit Ubuntu:26.04:LTS

    Versions
    • 1.7.10-2
    • 1.7.10-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →