{"id":"CVE-2026-109584","kind":"vulnerability","aliases":["CVE-2026-109584"],"related":[],"title":"Bandit: HTTP/2 HPACK cookie expansion lets small requests exhaust server memory","description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.\n\nBandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.\n\nThis issue affects bandit: from 0.3.3 before 1.14.0.","summary":"Bandit, an Elixir HTTP server, decompresses a small HTTP/2 HEADERS block into a very large cookie value before any application code runs. An unauthenticated remote attacker can use one request of about 49 KB to make the server allocate around 183 MB, and parallel streams multiply the cost, which can exhaust memory.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","package","phoenix","self-hosted"],"not_affected_if":["bandit-1.14.0-or-later","http2-disabled"],"how_to_check":"- Check the Bandit version in `mix.lock` or `mix deps` output; affected versions are from `0.3.3` before `1.14.0`.\n- Confirm HTTP/2 is served by Bandit (for example Phoenix endpoints using `plug_cowboy` replacement with `bandit` and HTTP/2 enabled).\n- Check whether `max_header_list_size` is set in the Bandit HTTP/2 options; the sources say it defaults to `:infinity`.","fix":"- Upgrade `bandit` to `1.14.0` or later.\n- Until upgraded, set a finite `max_header_list_size` in the HTTP/2 options (value not specified in the sources, so unknown).","status":"open","published_at":"2026-10-26T14:16:25+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:13+00:00","updated_at":"2026-10-26T14:32:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:32:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `bandit` to `1.14.0` or later.\n- Until upgraded, set a finite `max_header_list_size` in the HTTP/2 options (value not specified in the sources, so unknown).","reach":"internet","title":"Bandit: HTTP/2 HPACK cookie expansion lets small requests exhaust server memory","impact":"medium","summary":"Bandit, an Elixir HTTP server, decompresses a small HTTP/2 HEADERS block into a very large cookie value before any application code runs. An unauthenticated remote attacker can use one request of about 49 KB to make the server allocate around 183 MB, and parallel streams multiply the cost, which can exhaust memory.","category":"package","nicknames":[],"who_cares":["elixir","phoenix","bandit","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote unauthenticated attacker exhausts server memory, causing denial of service.","analyst_note":"","how_to_check":"- Check the Bandit version in `mix.lock` or `mix deps` output; affected versions are from `0.3.3` before `1.14.0`.\n- Confirm HTTP/2 is served by Bandit (for example Phoenix endpoints using `plug_cowboy` replacement with `bandit` and HTTP/2 enabled).\n- Check whether `max_header_list_size` is set in the Bandit HTTP/2 options; the sources say it defaults to `:infinity`.","needs_analyst":false,"not_affected_if":["bandit-1.14.0-or-later","http2-disabled"],"who_is_affected":"Teams running Bandit as an HTTP/2-capable server, most often Elixir and Phoenix applications serving HTTP/2 directly to the internet. Servers behind a proxy that terminates HTTP/2 or does not serve HTTP/2 to clients are less exposed; the sources do not say how much a proxy reduces the risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3549,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109584':14A,17A '-2026':13A,16A '0.3.3':217C '1':132C '1.14.0':219C '183':65B,153C '49':57B,142C 'affect':214C 'alloc':63B,151C 'allow':93C 'amplif':84C 'applic':44B,159C 'around':64B 'attack':50B,97C 'bandit':1A,18B,25B,92C,215C 'bandit.http2.connection':170C 'binari':156C,211C 'block':35B,109C,111C,144C,175C,178C 'byte':133C 'cap':171C 'check':182C 'code':45B,160C 'combin':200C 'compress':81C,107C,174C 'concurr':164C 'cooki':4A,40B,115C,155C,201C 'cost':72B,169C 'crumb':208C 'crumbs/1':202C 'cve':12A,15A 'data':82C,83C 'decod':185C 'decompress':30B 'default':149C,197C 'dynam':120C 'elixir':19B,27B 'everi':163C,207C 'exhaust':9A,75B,99C 'expans':5A 'field':135C 'fire':193C 'handl':78C 'header':34B,108C,177C,189C 'high':80C 'host':24B 'hpack':3A,106C,119C 'hpack-compress':105C 'http':28B 'http/2':2A,33B,88C 'implement':89C 'improp':77C 'index':134C 'infin':199C 'issu':213C 'join':206C 'kb':58B,143C 'larg':39B,114C 'let':6A 'lib/bandit/http2/stream.ex':204C 'list':186C,190C 'made':145C 'make':60B 'max':176C,188C 'mb':66B,154C 'memori':11A,76B,101C 'mtrudel':91C 'multipli':70B 'never':192C 'one':53B,113C,210C 'packag':20B 'parallel':68B 'phoenix':21B 'ran':161C 'refer':124C 'remot':49B,96C 'repeat':167C 'report':138C 'request':8A,54B 'run':46B,140C 'self':23B 'self-host':22B 'server':10A,29B,62B,100C,147C 'set':150C,196C 'size':179C,191C 'small':7A,32B,104C 'store':112C 'stream':69B,165C 'tabl':121C 'ten':126C 'thousand':128C 'time':130C 'unauthent':48B,95C 'use':52B 'valu':41B,116C 'via':102C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams running Bandit as an HTTP/2-capable server, most often Elixir and Phoenix applications serving HTTP/2 directly to the internet. Servers behind a proxy that terminates HTTP/2 or does not serve HTTP/2 to clients are less exposed; the sources do not say how much a proxy reduces the risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109584","severity":null,"published_at":"2026-10-26T14:16:25+00:00","modified_at":"2026-10-26T14:16:25+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}