CVE-2026-109584: HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Q: Which deployments are exposed by default?

Bandit HTTP/2 servers are exposed when running affected versions with the default max_header_list_size of :infinity. The compressed-header-block limit alone does not prevent this allocation expansion.

Q: Does exploitation require authentication or application-level request handling?

No. An unauthenticated remote attacker can trigger the allocation with a crafted HPACK-compressed HTTP/2 HEADERS block, before application code runs.

Q: What can be done if upgrading is not immediately possible?

Configure a finite max_header_list_size rather than leaving it at the default of :infinity. This prevents the decoded header-list-size check from remaining unlimited.

Q: Which Bandit versions need remediation?

The issue affects bandit versions from 0.3.3 before 1.14.0. Version 1.14.0 is outside the affected range.

Published Oct 26, 2026

Updated

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.

Bandit.HTTP2.Connection caps only the compressed block (maxheaderblocksize), and its check of the decoded list against maxheaderlistsize never fires because that setting defaults to :infinity. combinecookiecrumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.

This issue affects bandit: from 0.3.3 before 1.14.0.

Affected Software

1 affected component

hex/bandit>=0.3.3<1.14.0

Event History

Oct 26, 2026

CVE Published

via MITRE·01:32 PM

Data Sourced

via MITRE·01:32 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed by default?

Bandit HTTP/2 servers are exposed when running affected versions with the default max_header_list_size of :infinity. The compressed-header-block limit alone does not prevent this allocation expansion.

Does exploitation require authentication or application-level request handling?

No. An unauthenticated remote attacker can trigger the allocation with a crafted HPACK-compressed HTTP/2 HEADERS block, before application code runs.

What can be done if upgrading is not immediately possible?

Configure a finite max_header_list_size rather than leaving it at the default of :infinity. This prevents the decoded header-list-size check from remaining unlimited.

Which Bandit versions need remediation?

The issue affects bandit versions from 0.3.3 before 1.14.0. Version 1.14.0 is outside the affected range.

CVE-2026-109584: HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed by default?

Does exploitation require authentication or application-level request handling?

What can be done if upgrading is not immediately possible?

Which Bandit versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed by default?

Does exploitation require authentication or application-level request handling?

What can be done if upgrading is not immediately possible?

Which Bandit versions need remediation?