Bandit: Memory exhaustion via HTTP/2 cookie crumb join (data amplification)
Summary
Bandit, a pure-Elixir HTTP server for Plug and WebSock applications, joins cookie crumbs from HPACK-compressed HTTP/2 headers into one large binary without a limit on the decoded header size. An unauthenticated remote attacker can send a small header block (about 49 KB in the reporter's test) that expands to roughly 183 MB of memory before application code runs. Repeating the request across concurrent streams can exhaust memory on the BEAM node and take down all applications running on it.
Affected
- Bandit from 0.3.3 before 1.14.0
- Servers using default HTTP/2 settings are affected per the advisory
Fixed in
- Bandit 1.14.0 (released 26 Oct 2026)
- Bandit 1.14.1 also contains the fix (released 28 Oct 2026, addresses a different advisory)
Workaround
- On Bandit 1.12.2 and later, set a finite max_header_list_size, for example http_2_options: [default_local_settings: [max_header_list_size: 65_536]]
- From 0.7.0, disable HTTP/2 with http_2_options: [enabled: false] (HTTP/2 clients then fall back to HTTP/1.1)
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No evidence of in-the-wild exploitation or public proof of concept found in the sources reviewed
- NVD status: Awaiting Analysis
Our recommendation
- Identify Elixir applications using Bandit (for example via mix.lock) and check whether they are reachable from the internet over HTTP/2
- Upgrade to Bandit 1.14.0 or later, preferably the current 1.14.x release, which also covers other HTTP/2 advisories
- If patching is delayed, apply the workaround and plan the upgrade
- Monitor memory usage of Elixir nodes for unusual growth
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Program / EEF record cna.erlef.org
- GitHub Security Advisory GHSA-7gfj-7gvq-3xqj github.com
- Fix commit 220b9df github.com
- Introducing commit 44bf969 github.com
- OSV record EEF-CVE-2026-109584 osv.dev
- Tenable CVE page www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:14.
Original description (NVD)
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-109584.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4
- https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj
- https://osv.dev/vulnerability/EEF-CVE-2026-109584
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.