CVE-2026-109584

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.

• CWE-409

• https://cna.erlef.org/cves/CVE-2026-109584.html
• https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
• https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4
• https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj
• https://osv.dev/vulnerability/EEF-CVE-2026-109584

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109572Open WebUI from 0.8.6 before 0.11.4 contains a privilege esc…7.6
• CVE-2026-109573phpMyFAQ before 4.1.9 contains an SQL injection vulnerabilit…8.1
• CVE-2026-109574Hugo before v0.167.0 contains a path traversal vulnerability…5.5
• CVE-2026-109575In HAProxy Data Plane API 2.2.0 through 3.4.3 (and correspon…9.8
• CVE-2026-109576The parser in PEAK-System PCAN driver correctly detected the…5.5
• CVE-2026-10958Use after free in Chrome for iOS in Google Chrome on iOS pri…8.8
• CVE-2026-109587Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch…8.8
• CVE-2026-109588Numeric truncation of the buffer length in the MPU buffer au…8.8
• CVE-2026-10959Use after free in Input in Google Chrome on Android prior to…8.8
• CVE-2026-109590The Tour Booking Manager plugin for WordPress is vulnerable …6.4
• CVE-2026-109592The OpenStation: Desktop Windows, Dock & Virtual Desktops fo…4.3
• CVE-2026-109593An unauthenticated attacker with network access to the Sonic…9.1