Live › vulnerability › CVE-2026-109584
Go to dashboardBandit, an Elixir HTTP server, decompresses a small HTTP/2 HEADERS block into a very large cookie value before any application code runs. An unauthenticated remote attacker can use one request of about 49 KB to make the server allocate around 183 MB, and parallel streams multiply the cost, which can exhaust memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running Bandit as an HTTP/2-capable server, most often Elixir and Phoenix applications serving HTTP/2 directly to the internet. Servers behind a proxy that terminates HTTP/2 or does not serve HTTP/2 to clients are less exposed; the sources do not say how much a proxy reduces the risk.
No product ranges from the sources yet.
mix.lock or mix deps output; affected versions are from 0.3.3 before 1.14.0.plug_cowboy replacement with bandit and HTTP/2 enabled).max_header_list_size is set in the Bandit HTTP/2 options; the sources say it defaults to :infinity.bandit to 1.14.0 or later.max_header_list_size in the HTTP/2 options (value not specified in the sources, so unknown).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.
Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.
This issue affects bandit: from 0.3.3 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-109584")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.