High 8.7Published Oct 26, 2026

CVE-2026-109584HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Updated under an hour ago (Oct 30, 2026, 2:30 AM ET)

Does this affect you?

It affects mtrudel bandit. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.60%, higher than 49% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for mtrudel bandit Exploited in the last 30 days

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-409
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.60% (percentile 49)
Assigned by: EEF
NVD analysis: Awaiting Analysis
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

mtrudel bandit mtrudel:bandit	from 0.3.3 before 1.14.0	CNA record

References

References

https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-109584.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-109584	related
https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4	related
https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.