{"id":"CVE-2026-109584","aliases":[],"cve":{"records":[{"id":"CVE-2026-109584","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T10:15:01.793Z","published":"2026-10-26T13:32:22.359Z","modified":"2026-10-26T15:35:51.081Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-26T13:32:22.359Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T15:35:51.081Z"}],"references":[{"url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-109584.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-109584","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4","tags":["related"],"source":"EEF"},{"url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a","tags":["patch"],"source":"EEF"}],"weaknesses":[{"id":"CWE-409","description":"CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.0","versionStartIncluding":"0.3.3","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T15:11:12.403348Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit","titleSource":"EEF","descriptionSource":"EEF","description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0.","score":8.7,"severity":"high","published":"2026-10-26T13:32:22.359Z","modified":"2026-10-26T15:35:51.081Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"0.3.3","status":"affected","lessThan":"1.14.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/bandit","packageIdentity":{"ecosystem":"Hex","name":"bandit"},"cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109584"},{"vendor":"mtrudel","name":"bandit","platforms":[],"versions":[{"version":"44bf969cd59851622fb6ee4d16227fbc39a77fb4","status":"affected","lessThan":"220b9dfd27f9a21305be2afc75cbe585ddc24e7a","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/mtrudel/bandit","cpes":["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109584"}],"remediation":[{"text":"On 1.12.2 and later, set a finite decoded header list limit, for example http_2_options: [default_local_settings: [max_header_list_size: 65_536]], which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the vulnerable path.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109584"}],"references":["https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj","https://cna.erlef.org/cves/CVE-2026-109584.html","https://osv.dev/vulnerability/EEF-CVE-2026-109584","https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4","https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"],"sources":[{"name":"CVE","id":"CVE-2026-109584","modified":"2026-10-26T15:35:51.081Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109584"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:27:19.082Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:25:31.914Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Bandit HTTP/2 implementation is vulnerable to improper handling of highly compressed data, allowing an unauthenticated remote attacker to exhaust server memory. This affects Bandit versions from 0.3.3 before 1.14.0. An attacker can send a small HPACK-compressed HEADERS block to cause a large allocation.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:37:09.218Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-109584"}]}}