HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.

Timeline

1. Aug 20, 2026, 9:11 PM UTCCVE published
2. Aug 21, 2026, 7:52 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Aug 21, 2026, 7:52 PM UTCRecord last updated

Affected versions

• bandit

  From 1.4.0 · fixed in 1.12.5

• mtrudel/bandit

  Version range not reported

References 4