CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
Bandit HTTP/2 server fails to validate CR, LF, or NUL characters in header values, allowing potential CRLF injection in downstream applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75484?
CVE-2026-75484 is a medium-severity vulnerability in mtrudel bandit, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not.
Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application.
This issue affects bandit: from 1.4.0 before 1.12.5.
Weakness: CWE-93
Which versions are affected by CVE-2026-75484?
1 open source package ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 1.4.0 | 1.12.5 |
How do I fix CVE-2026-75484?
Upgrade bandit to 1.12.5 or later.
Is CVE-2026-75484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75484 exists.
Sources
Also known as EEF-CVE-2026-75484, GHSA-23xx-x3px-xxpj, GHSA-x3gh-xhj4-3vq8.