CVE-2026-75484: Bandit HTTP/2 Header Injection Vulnerability
Summary
CVE-2026-75484: HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit. Affects bandit across 2 version ranges.
>= 1.4.0, < 1.12.5
>= fff06efe3be962b484bd4d3eb339372fda5a231f, < d38cf046c9a3cae4d0f88001c2ceb4143f86366b
Fixed in 1.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bandit is an open-source application designed for handling HTTP/2 requests efficiently. It is built to manage various aspects of HTTP/2 communication, including header management and connection handling. However, it has a vulnerability that allows unvalidated CR, LF, or NUL characters in header field values, which can lead to potential security risks in downstream applications.
Vulnerability Detail
The vulnerability arises from improper neutralization of CRLF sequences, allowing an unauthenticated remote attacker to inject CR, LF, or NUL characters into application-visible request headers via HTTP/2. The Bandit package validates certain header attributes but fails to check the field values, which can lead to security issues when these values are consumed by downstream applications. The risk is particularly significant when header values are logged or concatenated into upstream requests, potentially leading to log injection or request smuggling attacks. This vulnerability affects Bandit versions from 1.4.0 to 1.12.5.
How To Fix
Minimum fixed version
1.12.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the application side to sanitize header values before they are processed. This can help mitigate the risk of CRLF injection until the package is updated. For example, you can filter out any CR, LF, or NUL characters from header values before logging or processing them.
Conclusion
CVE-2026-75484 presents a significant security risk in the Bandit package due to improper validation of HTTP/2 header field values. It is crucial for developers to update to the patched version and implement necessary workarounds to safeguard their applications against potential attacks.
See every vulnerability recorded for bandit →
FAQ
CVE-2026-75484 is a vulnerability in the Bandit package that allows for CRLF injection in HTTP/2 header field values.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in real-time.
CRLF characters are carriage return (CR) and line feed (LF) characters that are used to signify the end of a line in text files. In HTTP headers, they can be exploited to inject malicious content.
If immediate updates are not possible, implement input validation to sanitize header values and prevent CRLF characters from being processed.
The CVSS score of this vulnerability is 6.9, indicating a medium level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for bandit.
