mtrudel Bandit CVE-2026-109584

Exploitation requires that the target have HTTP/2 enabled (the default) and retain the shipped defaults where max_header_list_size is :infinity, so Bandit.HTTP2.Connection never rejects the decoded header list; max_concurrent_streams also defaults to :infinity, amplifying impact across streams. No authentication or user interaction is needed (PR:N/UI:N), and default configurations of mtrudel bandit versions 0.3.3 through before 1.14.0 are exploitable remotely. Limiting factors stated by the vendor: on 1.12.2 and later, setting a finite decoded header list limit (e.g. http_2_options: [default_local_settings: [max_header_list_size: 65_536]]) resets the stream before the cookie crumbs are joined; on any version, disabling HTTP/2 (http_2_options: [enabled: false]) removes the vulnerable path. The vendor indicates upgrading to 1.14.0 is the complete fix.

All signals point to a genuine availability risk rather than CVSS inflation. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes remote, network-reachable exploitation with low complexity, no attack requirements, no privileges and no user interaction, impacting only availability - consistent with the CWE-409 data-amplification mechanism and the described memory exhaustion. The provided 8.7 score is therefore driven purely by the VA:H availability impact against an unauthenticated remote path, which is credible. EPSS is not provided in the input, and the vulnerability is NOT on CISA KEV, so there is no evidence of active exploitation - the distribution here is vulnerable to targeted abuse rather than confirmed widespread attack. A detailed public PoC methodology is published in the GHSA advisory (block construction, frame sequencing, and a reproduced 49 KB → 183 MB amplification), but the input does not mark it as confirmed working exploit code. The vendor-assigned priority is 'this_week', which is the governing urgency signal and aligns with a serious-but-not-emergency DoS. One nuance to verify: the NVD/description says the flaw affects 'default settings', while the advisory simultaneously documents a configuration (finite max_header_list_size on 1.12.2+) that neutralizes it - so real-world exposure depends on whether operators have left max_header_list_size at its :infinity default, which is the shipped default.

An unauthenticated remote attacker opens an HTTP/2 connection to a default-configured Bandit server and sends a ~49 KB HPACK HEADERS/CONTINUATION block that stores one 4,058-byte cookie in the dynamic table and references it ~45,000 times with 1-byte indexed fields. Bandit's combine_cookie_crumbs/1 joins the crumbs into a ~183 MB binary before any application code runs, and because max_concurrent_streams also defaults to :infinity, repeating this across streams exhausts the BEAM node's memory and takes down every application on it. A detailed public PoC reference exists in the GHSA advisory; it is not verified as working exploit code in the provided input.