CVE-2026-42786
Description
A flaw was found in bandit. A remote, unauthenticated attacker can exploit an Allocation of Resources Without Limits or Throttling vulnerability in the fragment reassembly path of the WebSocket connection handling. This allows the attacker to send an unbounded number of continuation frames, leading to uncontrolled memory growth and ultimately a denial of service (DoS) by exhausting system resources.
Statement
This IMPORTANT DoS vulnerability in Bandit's WebSocket handling allows unauthenticated memory exhaustion via unbounded continuation frames. Unlike CVE-2026-39804, this affects stock Phoenix and LiveView applications since accumulation happens before WebSock.handle_in is called. Impact is high availability loss. Affects Bandit versions 0.5.0 to before 1.11.0.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
