CVE-2026-109584
Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion via HPACK Compression in Bandit HTTP/2

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-109584
EUVD
EUVD-2026-109826

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.3.3
mtrudel bandit 44bf969cd59851622fb6ee4d16227fbc39a77fb4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a data amplification vulnerability in the HTTP/2 implementation of the Bandit web server. An unauthenticated remote attacker can exploit it by sending a small HPACK-compressed HEADERS block that stores a large cookie value in the HPACK dynamic table and references it many times with 1-byte indexed fields. This causes the server to allocate excessive memory for the cookie binary before processing any application code.

Detection Guidance

Detect this vulnerability by monitoring HTTP/2 traffic for unusually large HPACK-compressed headers or repeated small indexed fields referencing large cookie values. Check server memory usage spikes during HTTP/2 connections. Inspect Bandit versions between 0.3.3 and 1.14.0 for potential exposure.

Impact Analysis

This vulnerability can lead to server memory exhaustion, causing denial of service by crashing or severely degrading performance of the Bandit web server. An attacker could repeatedly trigger this issue, consuming server resources and potentially disrupting service for legitimate users.

Mitigation Strategies

Upgrade Bandit to version 1.14.0 or later to address the improper handling of compressed data. Configure max_header_list_size to a finite value to prevent unbounded memory allocation. Monitor and limit HTTP/2 header block sizes to mitigate amplification risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart