Vulnerability · Published Oct 26, 2026 · Assigned by EEF
CVE-2026-109584HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
High 8.7
In plain English
A high-severity security flaw in bandit from mtrudel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-109584 |
| Ubuntu:24.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-109584 |
| Ubuntu:26.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-109584 |
| Ubuntu:26.10 | bandit | no fix listed | UBUNTU-CVE-2026-109584 |
Affected products (as reported)
Weakness: CWE-409 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N