Data Amplification Vulnerability in HTTP/2 Implementation of mtrudel Bandit

CVE-2026-109584

What is CVE-2026-109584?

The vulnerability in mtrudel Bandit's HTTP/2 implementation arises from its improper handling of HPACK-compressed HEADER blocks. An unauthenticated remote attacker can exploit this issue to exhaust server memory by using a small yet maliciously crafted HEADERS block, which expands a single large cookie value into substantial memory allocations. This exploitation can lead to significant resource depletion, as the block can be referenced repeatedly, resulting in very high memory consumption even with default server settings. Affected versions range from 0.3.3 to those prior to 1.14.0, highlighting the urgent need for users to update to patched versions to mitigate this risk.

References