The vulnerability is in the HTTP/2 implementation of the Bandit web server. A small, HPACK‑compressed HEADERS block that contains a large cookie value can be referenced thousands of times through 1‑byte indexed fields. When the server expands the cookie crumbs, it subsequently allocates a binary that is far larger than the compressed size, leading to an unbounded memory allocation. Because the vulnerability is triggered before any application code runs, an attacker can cause the server to consume large amounts of memory and potentially crash or become unresponsive. The flaw is an instance of Improper Limitation of Input Size (CWE‑409).

The issue affects the Bandit web server from version 0.3.3 up to, but not including, 1.14.0. The affected package is maintained by mtrudel. No other products or versions are listed.

The CVSS score of 8.7 classifies the problem as high severity, and the vulnerability can be triggered by an unauthenticated remote attacker who can send a crafted HTTP/2 request from any network source. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker that understands the HPACK format or who can leverage the Bandit server in a high‑traffic environment could repeatedly trigger memory exhaustion, potentially resulting in denial of service. Since the attacker needs only to send data, no additional privilege is required and the attack can be performed over any HTTP/2 enabled proxy or directly to the Bandit server.