CRLF Injection Vulnerability in Bandit by Mtrudel

CVE-2026-75484

What is CVE-2026-75484?

An unauthorized remote attacker can exploit a CRLF Injection vulnerability in Mtrudel's Bandit, allowing them to incorporate CR, LF, or NUL characters into application-specific request headers. This occurs through the HTTP/2 protocol as the validation on header values does not adequately reject these characters, leading to potential risks in how downstream applications handle these headers. Notably, a weakness in header handling could allow manipulated values to impact logging mechanisms and other request handling processes.

References