CVE-2026-75484 mtrudel CVE debrief

Who should care

Developers and administrators using bandit versions between 1.4.0 and 1.12.4 should be aware of this vulnerability and take steps to mitigate it. Downstream applications that consume header values from bandit may also be affected. Security teams and vulnerability management teams should prioritize this vulnerability given its CVSS score of 6.9 and the potential for header injection attacks.

Technical summary

The CVE-2026-75484 vulnerability in bandit allows an unauthenticated remote attacker to inject CR, LF, or NUL characters into application-visible request headers via HTTP/2 due to improper neutralization of CRLF sequences. The risk lies in how downstream applications consume header values, such as logging or concatenating them into upstream requests. The vulnerability was fixed in bandit version 1.12.5. Bandit itself is not a sink for the injected bytes, but the risk is in how downstream applications handle these injected characters.

Defensive priority

Medium priority given the CVSS score of 6.9 and the potential for header injection attacks.

Recommended defensive actions

• Review and update bandit to version 1.12.5 or later
• Verify downstream applications for potential header injection vulnerabilities
• Implement additional input validation and sanitization for HTTP/2 requests
• Monitor for suspicious traffic patterns that could indicate exploitation attempts
• Conduct a thorough review of the affected systems to identify potential exposure
• Develop and implement compensating controls for exposed systems
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved

Evidence notes

The CVE-2026-75484 record indicates an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in bandit, allowing an unauthenticated remote attacker to inject CR, LF, or NUL characters into application-visible request headers via HTTP/2. Limited details are provided about downstream application impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.