HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

bandit · CWE-409 · CWE-409

Affectedbandit, mtrudel/bandit

FixUpdate to 1.14.0, 220b9dfd27f9a21305be2afc75cbe585ddc24e7a or newer

PublishedOct 26, 13:32 · EEF

ScoredOct 26 · 8.7 · EEF

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:09 UTC

What we know

No known exploitation. CISA KEV, checked 22:09 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

A successful attack can take the service down. CVSS impact.

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

From EEF

Affected and fixed versions

ProductAffectedFixed inbandit0.3.3 – before 1.14.01.14.0mtrudel/bandit44bf969cd59851622fb6ee4d16227fbc39a77fb4 – before 220b9dfd27f9a21305be2afc75cbe585ddc24e7a220b9dfd27f9a21305be2afc75cbe585ddc24e7a

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit · github.comvendor advisoryrelated EEF CNA record for CVE-2026-109584 · cna.erlef.orgrelated OSV record EEF-CVE-2026-109584 · osv.devrelated Introducing commit 44bf969 in mtrudel/bandit · github.comrelated Fix commit 220b9df in mtrudel/bandit · github.compatch

Other CVEs in bandit

All 23 →

8.7HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit · CVE-2026-116078Oct 28 8.7SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit · CVE-2026-108529Oct 26 8.7Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit · CVE-2026-110499Oct 26