CVE-2026-75484: Bandit Http2 Unvalidated Header Field Values
HTTP/2 header parsing does not validate header field values for CR, LF, or NUL characters (RFC 9113 §8.2.1). Unsanitized control characters in request headers can lead to log injection, HTTP request smuggling, or response splitting downstream.
Elixirgreprules fetch cve-2026-75484-bandit-http2-unvalidated-header-field-values --engine opengrepDescription
HTTP/2 header parsing does not validate header field values for CR, LF, or NUL characters (RFC 9113 §8.2.1). Unsanitized control characters in request headers can lead to log injection, HTTP request smuggling, or response splitting downstream.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.