Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.
Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.
This issue affects bandit: from 0.3.3 before 1.14.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mtrudel | bandit | 0.3.3 – < 1.14.0 | 1.14.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | bandit | No fix yet | — |
| Ubuntu 26.04 LTS | bandit | No fix yet | — |
| Ubuntu 24.04 LTS | bandit | No fix yet | — |
| Ubuntu 22.04 LTS | bandit | No fix yet | — |
| Ubuntu 20.04 LTS | bandit | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | bandit | No fix yet | — |
| Ubuntu 16.04 LTS | bandit | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | bandit | >= 0.3.3, < 1.14.0 | 1.14.0 | EEF-CVE-2026-109584 |
References
- HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit vendor-advisory related
- EEF CNA record for CVE-2026-109584 related
- OSV record EEF-CVE-2026-109584 related
- Introducing commit 44bf969 in mtrudel/bandit related
- Fix commit 220b9df in mtrudel/bandit patch