CVE-2026-75484

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.12.4

Description An improper neutralization of CRLF sequences allows an unauthenticated remote attacker to smuggle Carriage Return (CR), Line Feed (LF), or Null (NUL) characters into application-visible request headers via HTTP/2. The function Bandit.HTTP2.Stream.read headers/1 validates pseudo-header placement, uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but fails to check field values. Since HPACK carries arbitrary octets, a HEADERS block containing r, , or 0 decodes without error, and these values are placed in conn.req headers unchanged. While the HTTP/1 path rejects these octets, the HTTP/2 path does not. The risk occurs when a downstream application consumes these header values, such as by appending them to a plain-text log or concatenating them into an upstream request. Additionally, a duplicate :authority pseudo-header could be accepted, where the first instance is used as conn.host while a conflicting value remains visible to the application.

Recommendations Update bandit to version 1.12.5 or later.