{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:11:12.403348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:35:51.081Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "bandit",
          "packageURL": "pkg:hex/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "1.14.0",
              "status": "affected",
              "version": "0.3.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "product": "bandit",
          "repo": "https://github.com/mtrudel/bandit",
          "vendor": "mtrudel",
          "versions": [
            {
              "lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
              "status": "affected",
              "version": "44bf969cd59851622fb6ee4d16227fbc39a77fb4",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.14.0",
                  "versionStartIncluding": "0.3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mat Trudel"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-23T10:29:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large \u003ccode\u003ecookie\u003c/code\u003e value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e caps only the compressed block (\u003ccode\u003emax_header_block_size\u003c/code\u003e), and its check of the decoded list against \u003ccode\u003emax_header_list_size\u003c/code\u003e never fires because that setting defaults to \u003ccode\u003e:infinity\u003c/code\u003e. \u003ccode\u003ecombine_cookie_crumbs/1\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e then joins every crumb into one binary.\u003c/p\u003e\n\u003cp\u003eThis issue affects bandit: from 0.3.3 before 1.14.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large `cookie` value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\n`Bandit.HTTP2.Connection` caps only the compressed block (`max_header_block_size`), and its check of the decoded list against `max_header_list_size` never fires because that setting defaults to `:infinity`. `combine_cookie_crumbs/1` in `lib/bandit/http2/stream.ex` then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0."
            }
          ],
          "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-491",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node."
                }
              ],
              "value": "An unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:32:22.359Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj"
        },
        {
          "name": "EEF CNA record for CVE-2026-109584",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-109584.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-109584",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-109584"
        },
        {
          "name": "Introducing commit 44bf969 in mtrudel/bandit",
          "tags": [
            "related"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4"
        },
        {
          "name": "Fix commit 220b9df in mtrudel/bandit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn 1.12.2 and later, set a finite decoded header list limit, for example \u003ccode\u003ehttp_2_options: [default_local_settings: [max_header_list_size: 65_536]]\u003c/code\u003e, which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e removes the vulnerable path.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "On 1.12.2 and later, set a finite decoded header list limit, for example `http_2_options: [default_local_settings: [max_header_list_size: 65_536]]`, which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with `http_2_options: [enabled: false]` removes the vulnerable path."
            }
          ],
          "value": "On 1.12.2 and later, set a finite decoded header list limit, for example http_2_options: [default_local_settings: [max_header_list_size: 65_536]], which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the vulnerable path."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eAgainst a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte \u003ccode\u003ecookie\u003c/code\u003e stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\u003c/li\u003e\n\u003cli\u003eSend it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with \u003ccode\u003eEND_HEADERS\u003c/code\u003e on the last.\u003c/li\u003e\n\u003cli\u003eThe request reaches the plug with a \u003ccode\u003ecookie\u003c/code\u003e header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Against a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte `cookie` stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\n2. Send it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with `END_HEADERS` on the last.\n3. The request reaches the plug with a `cookie` header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it."
            }
          ],
          "value": "* Against a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte cookie stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\n* Send it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with END_HEADERS on the last.\n* The request reaches the plug with a cookie header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Compression\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte \u003ccode\u003emax_header_block_size\u003c/code\u003e. It inserts one 4,058-byte \u003ccode\u003ecookie\u003c/code\u003e into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. \u003ccode\u003eHPAX.decode\u003c/code\u003e returns a list whose entries all point at the same binary, so decoding itself stays cheap.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Missing decoded limit\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/settings.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003eAfter decoding, the connection compares \u003ccode\u003eheader_list_size(headers)\u003c/code\u003e against \u003ccode\u003elocal_settings.max_header_list_size\u003c/code\u003e. That setting defaults to \u003ccode\u003e:infinity\u003c/code\u003e, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Expansion\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eread_headers\u003c/code\u003e calls \u003ccode\u003ecombine_cookie_crumbs/1\u003c/code\u003e, which joins every crumb with \u003ccode\u003eEnum.map_join/3\u003c/code\u003e into a single binary of about 183 MB before \u003ccode\u003ePlug.call/2\u003c/code\u003e runs. \u003ccode\u003emax_concurrent_streams\u003c/code\u003e also defaults to \u003ccode\u003e:infinity\u003c/code\u003e, so N streams allocate N times as much.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Compression**\n\nThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte `max_header_block_size`. It inserts one 4,058-byte `cookie` into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. `HPAX.decode` returns a list whose entries all point at the same binary, so decoding itself stays cheap.\n\n**2. Missing decoded limit** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/settings.ex`)\n\nAfter decoding, the connection compares `header_list_size(headers)` against `local_settings.max_header_list_size`. That setting defaults to `:infinity`, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\n\n**3. Expansion** (`lib/bandit/http2/stream.ex`)\n\n`read_headers` calls `combine_cookie_crumbs/1`, which joins every crumb with `Enum.map_join/3` into a single binary of about 183 MB before `Plug.call/2` runs. `max_concurrent_streams` also defaults to `:infinity`, so N streams allocate N times as much."
            }
          ],
          "value": "1. Compression\n\nThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte max_header_block_size. It inserts one 4,058-byte cookie into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. HPAX.decode returns a list whose entries all point at the same binary, so decoding itself stays cheap.\n\n2. Missing decoded limit (lib/bandit/http2/connection.ex, lib/bandit/http2/settings.ex)\n\nAfter decoding, the connection compares header_list_size(headers) against local_settings.max_header_list_size. That setting defaults to :infinity, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\n\n3. Expansion (lib/bandit/http2/stream.ex)\n\nread_headers calls combine_cookie_crumbs/1, which joins every crumb with Enum.map_join/3 into a single binary of about 183 MB before Plug.call/2 runs. max_concurrent_streams also defaults to :infinity, so N streams allocate N times as much."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-109584",
    "datePublished": "2026-10-26T13:32:22.359Z",
    "dateReserved": "2026-10-22T10:15:01.793Z",
    "dateUpdated": "2026-10-26T15:35:51.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-109584\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-26T15:11:12.403348Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-26T15:32:36.017Z\"}}], \"cna\": {\"title\": \"HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Mat Trudel\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-491\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAn unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"An unauthenticated remote client can make any Bandit server with default HTTP/2 settings allocate a cookie binary thousands of times larger than the header block it sent, before any application code runs. Repeating it across concurrent streams exhausts the BEAM node\u0027s memory, taking down every application on the node.\", \"base64\": false}]}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.3.3\", \"lessThan\": \"1.14.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/bandit\", \"packageName\": \"bandit\", \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/mtrudel/bandit\", \"vendor\": \"mtrudel\", \"product\": \"bandit\", \"versions\": [{\"status\": \"affected\", \"version\": \"44bf969cd59851622fb6ee4d16227fbc39a77fb4\", \"lessThan\": \"220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/mtrudel/bandit\", \"packageName\": \"mtrudel/bandit\", \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj\", \"name\": \"HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-109584.html\", \"name\": \"EEF CNA record for CVE-2026-109584\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-109584\", \"name\": \"OSV record EEF-CVE-2026-109584\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4\", \"name\": \"Introducing commit 44bf969 in mtrudel/bandit\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a\", \"name\": \"Fix commit 220b9df in mtrudel/bandit\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"On 1.12.2 and later, set a finite decoded header list limit, for example http_2_options: [default_local_settings: [max_header_list_size: 65_536]], which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with http_2_options: [enabled: false] removes the vulnerable path.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn 1.12.2 and later, set a finite decoded header list limit, for example \u003ccode\u003ehttp_2_options: [default_local_settings: [max_header_list_size: 65_536]]\u003c/code\u003e, which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with \u003ccode\u003ehttp_2_options: [enabled: false]\u003c/code\u003e removes the vulnerable path.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"On 1.12.2 and later, set a finite decoded header list limit, for example `http_2_options: [default_local_settings: [max_header_list_size: 65_536]]`, which resets the stream before the cookie crumbs are joined. From 0.7.0, disabling HTTP/2 with `http_2_options: [enabled: false]` removes the vulnerable path.\", \"base64\": false}]}], \"dateAssigned\": \"2026-10-23T10:29:49.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\\n\\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\\n\\nThis issue affects bandit: from 0.3.3 before 1.14.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large \u003ccode\u003ecookie\u003c/code\u003e value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eBandit.HTTP2.Connection\u003c/code\u003e caps only the compressed block (\u003ccode\u003emax_header_block_size\u003c/code\u003e), and its check of the decoded list against \u003ccode\u003emax_header_list_size\u003c/code\u003e never fires because that setting defaults to \u003ccode\u003e:infinity\u003c/code\u003e. \u003ccode\u003ecombine_cookie_crumbs/1\u003c/code\u003e in \u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e then joins every crumb into one binary.\u003c/p\u003e\\n\u003cp\u003eThis issue affects bandit: from 0.3.3 before 1.14.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large `cookie` value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter\u0027s run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\\n\\n`Bandit.HTTP2.Connection` caps only the compressed block (`max_header_block_size`), and its check of the decoded list against `max_header_list_size` never fires because that setting defaults to `:infinity`. `combine_cookie_crumbs/1` in `lib/bandit/http2/stream.ex` then joins every crumb into one binary.\\n\\nThis issue affects bandit: from 0.3.3 before 1.14.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-409\", \"description\": \"CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.14.0\", \"versionStartIncluding\": \"0.3.3\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-10-26T13:32:22.359Z\"}, \"x_proofOfConcept\": [{\"lang\": \"en\", \"value\": \"* Against a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte cookie stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\\n* Send it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with END_HEADERS on the last.\\n* The request reaches the plug with a cookie header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003col\u003e\\n\u003cli\u003eAgainst a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte \u003ccode\u003ecookie\u003c/code\u003e stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\u003c/li\u003e\\n\u003cli\u003eSend it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with \u003ccode\u003eEND_HEADERS\u003c/code\u003e on the last.\u003c/li\u003e\\n\u003cli\u003eThe request reaches the plug with a \u003ccode\u003ecookie\u003c/code\u003e header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it.\u003c/li\u003e\\n\u003c/ol\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"1. Against a Bandit server with default HTTP/2 settings, build an HPACK header block with the request pseudo-headers plus a 4,058-byte `cookie` stored in the dynamic table and then referenced about 45,000 times with indexed representations. The block is about 49 KB.\\n2. Send it on one stream as a HEADERS frame followed by CONTINUATION frames of at most 16,384 bytes, with `END_HEADERS` on the last.\\n3. The request reaches the plug with a `cookie` header of about 183 MB, and VM memory grows by about the same amount. Repeat on further streams to multiply it.\", \"base64\": false}]}], \"x_technicalAnalysis\": [{\"lang\": \"en\", \"value\": \"1. Compression\\n\\nThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte max_header_block_size. It inserts one 4,058-byte cookie into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. HPAX.decode returns a list whose entries all point at the same binary, so decoding itself stays cheap.\\n\\n2. Missing decoded limit (lib/bandit/http2/connection.ex, lib/bandit/http2/settings.ex)\\n\\nAfter decoding, the connection compares header_list_size(headers) against local_settings.max_header_list_size. That setting defaults to :infinity, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\\n\\n3. Expansion (lib/bandit/http2/stream.ex)\\n\\nread_headers calls combine_cookie_crumbs/1, which joins every crumb with Enum.map_join/3 into a single binary of about 183 MB before Plug.call/2 runs. max_concurrent_streams also defaults to :infinity, so N streams allocate N times as much.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cstrong\u003e1. Compression\u003c/strong\u003e\u003c/p\u003e\\n\u003cp\u003eThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte \u003ccode\u003emax_header_block_size\u003c/code\u003e. It inserts one 4,058-byte \u003ccode\u003ecookie\u003c/code\u003e into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. \u003ccode\u003eHPAX.decode\u003c/code\u003e returns a list whose entries all point at the same binary, so decoding itself stays cheap.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e2. Missing decoded limit\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/connection.ex\u003c/code\u003e, \u003ccode\u003elib/bandit/http2/settings.ex\u003c/code\u003e)\u003c/p\u003e\\n\u003cp\u003eAfter decoding, the connection compares \u003ccode\u003eheader_list_size(headers)\u003c/code\u003e against \u003ccode\u003elocal_settings.max_header_list_size\u003c/code\u003e. That setting defaults to \u003ccode\u003e:infinity\u003c/code\u003e, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\u003c/p\u003e\\n\u003cp\u003e\u003cstrong\u003e3. Expansion\u003c/strong\u003e (\u003ccode\u003elib/bandit/http2/stream.ex\u003c/code\u003e)\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eread_headers\u003c/code\u003e calls \u003ccode\u003ecombine_cookie_crumbs/1\u003c/code\u003e, which joins every crumb with \u003ccode\u003eEnum.map_join/3\u003c/code\u003e into a single binary of about 183 MB before \u003ccode\u003ePlug.call/2\u003c/code\u003e runs. \u003ccode\u003emax_concurrent_streams\u003c/code\u003e also defaults to \u003ccode\u003e:infinity\u003c/code\u003e, so N streams allocate N times as much.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"**1. Compression**\\n\\nThe attacker\u0027s header block, split across HEADERS and CONTINUATION frames, stays under the 50,000-byte `max_header_block_size`. It inserts one 4,058-byte `cookie` into the 4,096-byte dynamic table, the largest value that fits, then references it about 45,000 times with 1-byte indexed representations. `HPAX.decode` returns a list whose entries all point at the same binary, so decoding itself stays cheap.\\n\\n**2. Missing decoded limit** (`lib/bandit/http2/connection.ex`, `lib/bandit/http2/settings.ex`)\\n\\nAfter decoding, the connection compares `header_list_size(headers)` against `local_settings.max_header_list_size`. That setting defaults to `:infinity`, and in Erlang term order every integer sorts below an atom, so the comparison never rejects a list. The limit is enforced only when an operator sets it.\\n\\n**3. Expansion** (`lib/bandit/http2/stream.ex`)\\n\\n`read_headers` calls `combine_cookie_crumbs/1`, which joins every crumb with `Enum.map_join/3` into a single binary of about 183 MB before `Plug.call/2` runs. `max_concurrent_streams` also defaults to `:infinity`, so N streams allocate N times as much.\", \"base64\": false}]}]}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-109584\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-26T15:35:51.081Z\", \"dateReserved\": \"2026-10-22T10:15:01.793Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-10-26T13:32:22.359Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}