CVE-2026-75484

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence; a duplicate :authority pseudo-header was accepted, with the first instance silently winning as conn.host while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.

## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. `Bandit.HTTP2.Stream.read_headers/1` validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the `te` value, and `content-length`, but never checks field *values*. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain `\r`, `\n`, or `\0` decodes without error and the values land in `conn.req_headers` unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or `inspect`, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's `put_resp_header`, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only `:method`, `:scheme`, and `:path` were checked for at most one occurrence; a duplicate `:authority` pseudo-header was accepted, with the first instance silently winning as `conn.host` while a conflicting value remained visible to the application. This issue affects bandit: from 1.4.0 before 1.12.5.

La vulnerabilidad de Neutralización Incorrecta de Secuencias CRLF ('Inyección CRLF') en mtrudel bandit permite a un atacante remoto no autenticado introducir caracteres CR, LF o NUL en los encabezados de solicitud visibles para la aplicación a través de HTTP/2. Bandit.HTTP2.Stream.read_headers/1 valida la ubicación y unicidad de los pseudo-encabezados, el uso de mayúsculas/minúsculas en los nombres de los encabezados, los encabezados específicos de la conexión, el valor te y la longitud del contenido, pero nunca verifica los valores de los campos. Debido a que HPACK transporta octetos arbitrarios, un bloque HEADERS cuyos valores de campo contienen \r, \n o \0 se decodifica sin error y los valores llegan a conn.req_headers sin cambios. La ruta HTTP/1 ya rechaza los mismos octetos; HTTP/2 no lo hacía. Bandit en sí mismo no es un sumidero para los bytes inyectados: su propio registro utiliza cadenas fijas o inspect, y los encabezados de respuesta HTTP/2 están codificados en HPACK y son rechazados por separado por put_resp_header de Plug, por lo que la división de respuesta no es alcanzable a través de esta ruta. El riesgo reside enteramente en cómo una aplicación descendente consume los valores de los encabezados, como adjuntar uno textualmente a un registro de texto plano o concatenarlo en una solicitud ascendente. Una brecha relacionada incluida en la misma corrección: solo se verificaba :method, :scheme y :path para una ocurrencia como máximo; se aceptaba un pseudo-encabezado :authority duplicado, con la primera instancia ganando silenciosamente como conn.host mientras que un valor en conflicto permanecía visible para la aplicación. Este problema afecta a bandit: desde 1.4.0 antes de 1.12.5.