Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75484— HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Quick assessment

Affected
mtrudel bandit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mtrudel Bandit 存在“CRLF 序列处理不当（CRLF 注入）”漏洞，未认证的远程攻击者可以通过 HTTP/2 将回车符（CR）、换行符（LF）或空字符（NUL） smuggle（ smuggling： smuggle 意为“暗中传送、走私”，在此语境下指非法植入）到应用程序可见的请求头中。 Bandit 的 函数会验证伪头的位置和唯一性、头部名称的大小写、连接特定头、 值以及 ，但从未检查字段值。由于 HPACK 编解码器可以携带任意八位字节，一个字段值包含 、 或 的 块在解码时不会报错，且这些值

CVSS 6.9 · Medium EPSS 0.55% · P44

Affected Version Matrix 2

VendorProduct Version RangeStatus
mtrudel bandit 1.4.0< 1.12.5 affected
fff06efe3be962b484bd4d3eb339372fda5a231f< d38cf046c9a3cae4d0f88001c2ceb4143f86366b affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75484

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mtrudel bandit 1.4.0 ~ 1.12.5 cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
mtrudel bandit fff06efe3be962b484bd4d3eb339372fda5a231f ~ d38cf046c9a3cae4d0f88001c2ceb4143f86366b cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-75484

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75484

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75484 (1)

Vendor Advisories for CVE-2026-75484 (3)

IV. Related Vulnerabilities

Same product: bandit
Same vendor: mtrudel
Same weakness: CWE-93

V. Comments for CVE-2026-75484

No comments yet

Leave a comment