CVE-2026-75484: bandit 1.4.0 to before 1.12.5

Affected technology

bandit · 1.4.0 to before 1.12.5
mtrudel

bandit · fff06efe3be962b484bd4d3eb339372fda5a231f to before d38cf046c9a3cae4d0f88001c2ceb4143f86366b
mtrudel

Component: 'Elixir.Bandit.HTTP2.Stream'
Function: 'Elixir.Bandit.HTTP2.Stream':read_headers/1
File: lib/bandit/http2/stream.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.