CVE catalog
CVE-2026-109584
UBUNTU-CVE-2026-109584
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.60% · Oct 27, 2026
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | bandit | 16.04 | 0.13.2-1 | vulnerable |
| Ubuntu | bandit | 16.04 | 0.13.2-3 | vulnerable |
| Ubuntu | bandit | 18.04 | 1.4.0-0ubuntu2 | vulnerable |
| Ubuntu | bandit | 20.04 | 1.5.1-3 | vulnerable |
| Ubuntu | bandit | 20.04 | 1.6.2-1 | vulnerable |
| Ubuntu | bandit | 22.04 | 1.6.2-1 | vulnerable |
| Ubuntu | bandit | 24.04 | 1.6.2-3 | vulnerable |
| Ubuntu | bandit | 26.10 | 1.7.10-3 | vulnerable |
| Ubuntu | bandit | 26.10 | 1.9.4-1 | vulnerable |
| Ubuntu | bandit | 26.04 | 1.7.10-2 | vulnerable |
| Ubuntu | bandit | 26.04 | 1.7.10-3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: