CVE-2026-75484
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.
Risk Assessment
The risk is that applications using Bandit may process malicious headers, potentially leading to log injection or request smuggling attacks.
Recommendation
It is recommended to immediately upgrade the Bandit library to version 1.12.5 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Bandit
See all- CVE-2026-42786High
A vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion, enabling unauthorized users to send an unbounded number of continuation frames. The issue occurs in the handle_frame/3 method, which lacks size limits for accumulated data.
- CVE-2026-74836High
A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.
- CVE-2026-65623High
Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.
- CVE-2026-39805Medium
A vulnerability in the Bandit library (Elixir) allows HTTP request smuggling via duplicate Content-Length headers. The server accepts the first header and treats the remaining data as a subsequent request on the same connection.
Original NVD description (English source)
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.