CVE-2026-42786
Description
A flaw was found in bandit. A remote, unauthenticated attacker can exploit an Allocation of Resources Without Limits or Throttling vulnerability in the fragment reassembly path of the WebSocket connection handling. This allows the attacker to send an unbounded number of continuation frames, leading to uncontrolled memory growth and ultimately a denial of service (DoS) by exhausting system resources.
Statement
This IMPORTANT DoS vulnerability in Bandit's WebSocket handling allows unauthenticated memory exhaustion via unbounded continuation frames. Unlike CVE-2026-39804, this affects stock Phoenix and LiveView applications since accumulation happens before WebSock.handle_in is called. Impact is high availability loss. Affects Bandit versions 0.5.0 to before 1.11.0.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
