AIKIDO-2026-140703

TL;DR

In bandit, hTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field *values*. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged.