CVE-2026-109584

Name of the Vulnerable Software and Affected Versions bandit versions 0.3.3 through 1.13.x

Description An unauthenticated remote attacker can cause server memory exhaustion through a data amplification issue in the HTTP/2 implementation. By sending a small HPACK-compressed HEADERS block that stores a large cookie value in the HPACK dynamic table and references it tens of thousands of times, the attacker can force the server to allocate a massive binary. This occurs because Bandit.HTTP2.Connection only limits the compressed block size via max header block size, while the max header list size setting defaults to :infinity, failing to reject the expanded list. The function combine cookie crumbs/1 in lib/bandit/http2/stream.ex then joins these references into a single large binary. Since max concurrent streams also defaults to :infinity, multiple concurrent streams can multiply this memory consumption, potentially crashing all applications on the BEAM node.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround for versions 1.12.2 and later, set a finite decoded header list limit by configuring http 2 options: [default local settings: [max header list size: 65 536]]. As a temporary workaround for versions 0.7.0 and later, disable HTTP/2 by configuring http 2 options: [enabled: false].