{"answers":{"affected":"1 open source package ship an affected version, including bandit.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75484 exists.","fix":"Upgrade bandit to 1.12.5 or later.","what":"CVE-2026-75484 is a medium-severity vulnerability in mtrudel bandit, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-75484 and fix it if it is affected.\n\nWhat it is: CVE-2026-75484 is a medium-severity vulnerability in mtrudel bandit, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75484 exists.\n\nAffected packages and fixed versions:\n- bandit (Hex): affected from 1.4.0; fixed in 1.12.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-75484/ (Markdown: https://insights.sbomify.com/CVE-2026-75484/index.md)","id":"CVE-2026-75484","markdown":"https://insights.sbomify.com/CVE-2026-75484/index.md","name":"CVE-2026-75484","record":{"aliases":["EEF-CVE-2026-75484","GHSA-23xx-x3px-xxpj","GHSA-x3gh-xhj4-3vq8"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_modify","other"],"network_reachable":"yes","non_default_config":false,"product_category":"Elixir HTTP/2 server","requires_auth":"none","summary":"Bandit HTTP/2 server fails to validate CR, LF, or NUL characters in header values, allowing potential CRLF injection in downstream applications.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences"}],"description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \\r, \\n, or \\0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not.\n\nBandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application.\n\nThis issue affects bandit: from 1.4.0 before 1.12.5.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit","id":"CVE-2026-75484","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"other","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"Must-gather: /tmp/kubeconfig retention","id":"CVE-2026-75485"},"packages":[{"ecosystem":"Hex","fixed":["1.12.5"],"introduced":["1.4.0"],"last_affected":[],"package":"bandit","purl":"pkg:hex/bandit","source":"EEF-CVE-2026-75484"}],"prev":{"headline":"powerlevel10k Control Character Injection via package.json Version","id":"CVE-2026-75483"},"products":["bandit"],"published":"2026-08-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-21","vendors":["mtrudel"]},"summary":"Bandit HTTP/2 server fails to validate CR, LF, or NUL characters in header values, allowing potential CRLF injection in downstream applications.","url":"https://insights.sbomify.com/CVE-2026-75484/"}