Bandit HTTP/2 Header Injection Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: EEF

Description

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-75484

Affected Vendors & Products

Vendor	Product	Version / Range
mtrudel	bandit	From 1.4.0 (inc) to 1.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This is a CRLF injection vulnerability in the Bandit HTTP/2 server library. It allows unauthenticated remote attackers to inject carriage return, line feed, or null characters into HTTP headers. The issue occurs because Bandit's HTTP/2 header validation does not check header field values for these characters, which are then passed unchanged to downstream applications. This could lead to header injection or log poisoning if applications process these headers unsafely.

Impact Analysis

If you use Bandit versions 1.4.0 to 1.12.4, an attacker could inject malicious headers that might alter application behavior, poison logs, or manipulate downstream requests. The impact depends on how your application processes header values, such as logging or forwarding them.

Mitigation Strategies

Upgrade bandit to version 1.12.5 or later to address the CRLF injection vulnerability in HTTP/2 header handling.

Hi! I’m here to help you understand CVE-2026-75484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70