---
id: "CVE-2026-109584"
kind: "vulnerability"
aliases: ["CVE-2026-109584"]
title: "Bandit: HTTP/2 HPACK cookie expansion lets small requests exhaust server memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bandit", "elixir", "package", "phoenix", "self-hosted"]
not_affected_if: ["bandit-1.14.0-or-later", "http2-disabled"]
published_at: "2026-10-26T14:16:25+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109584", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Bandit: HTTP/2 HPACK cookie expansion lets small requests exhaust server memory

Bandit, an Elixir HTTP server, decompresses a small HTTP/2 HEADERS block into a very large cookie value before any application code runs. An unauthenticated remote attacker can use one request of about 49 KB to make the server allocate around 183 MB, and parallel streams multiply the cost, which can exhaust memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Bandit version in `mix.lock` or `mix deps` output; affected versions are from `0.3.3` before `1.14.0`.
- Confirm HTTP/2 is served by Bandit (for example Phoenix endpoints using `plug_cowboy` replacement with `bandit` and HTTP/2 enabled).
- Check whether `max_header_list_size` is set in the Bandit HTTP/2 options; the sources say it defaults to `:infinity`.

## Fix

- Upgrade `bandit` to `1.14.0` or later.
- Until upgraded, set a finite `max_header_list_size` in the HTTP/2 options (value not specified in the sources, so unknown).

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109584

## From the sources

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost.

Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary.

This issue affects bandit: from 0.3.3 before 1.14.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_