PT-2026-36543 · Phoenix Framework+1 · Phoenix+1

Jonatan Männchen + 2 · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-42786

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bandit versions 0.5.0 through 1.10.x

Description An unauthenticated remote attacker can cause a denial of service via memory exhaustion. The fragment reassembly path in the handle frame/3 function within Elixir.Bandit.WebSocket.Connection appends payloads from incoming Continuation{fin: false} frames to a per-connection iolist without a cumulative size limit. While the max frame size option limits individual frames, a peer can stream an unlimited number of continuation frames without setting fin=1, causing the BEAM heap to grow linearly until the process is terminated by the operating system or a supervisor. This accumulation occurs before WebSock.handle in/2 is called, preventing the application from implementing a size check. Consequently, stock Phoenix applications using Phoenix Channels and LiveView are exposed when accepting socket connections.

Recommendations Update to version 1.11.0 or later. As a temporary mitigation, ensure the application does not expose WebSocket endpoints if they are not required.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-42786

Affected Products

Bandit

Phoenix

References · 6

• 🔥 https://github.com/mtrudel/bandit/security/advisories/GHSA-pf94-94m9-536p · Exploit
• https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42786 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-42786 · Vendor Advisory
• https://hex.pm/packages/bandit · Note
• https://cna.erlef.org/cves/CVE-2026-42786.html · Note