CVE-2026-75484: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in mtrudel bandit

The vulnerability in mtrudel bandit involves improper neutralization of CRLF sequences in HTTP/2 request headers. While bandit validates pseudo-header placement, uniqueness, and certain header fields, it does not check for CR, LF, or NUL characters in header field values. Because HPACK encoding allows arbitrary octets, these characters can be injected and appear unchanged in conn.req_headers. The HTTP/1 path rejects these characters, but HTTP/2 does not. Bandit's own logging and response headers are not vulnerable to response splitting via this flaw. The main risk is how downstream applications consume these headers, potentially leading to injection attacks in logs or upstream requests. Additionally, only :method, :scheme, and :path pseudo-headers were limited to one occurrence; duplicate :authority headers were accepted, which could cause inconsistent host handling. This affects bandit versions >=1.4.0 and <1.12.5.

An unauthenticated remote attacker can inject CR, LF, or NUL characters into HTTP/2 request headers visible to the application. This can lead to injection issues depending on how downstream applications process these headers, such as log injection or request smuggling. Bandit's internal logging and response headers are not directly exploitable via this vulnerability. The presence of duplicate :authority pseudo-headers could cause inconsistent host resolution in applications relying on conn.host. The CVSS score of 6.9 indicates a medium severity impact with network attack vector and no privileges or user interaction required.

A fixed version of bandit is available starting from version 1.12.5. Users should upgrade to bandit 1.12.5 or later to address this vulnerability. No additional mitigation is required if the upgrade is applied. If immediate upgrade is not possible, downstream applications should carefully validate and sanitize HTTP/2 header field values before use to prevent injection risks. However, the primary remediation is to apply the official fix in bandit 1.12.5.