CVE-2026-109584 - HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
CVE ID :CVE-2026-109584 Published : Oct. 26, 2026, 1:32 p.m. | 50 minutes ago Description :Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a...