PT-2026-37059 · Phoenix · Phoenix

Peter Ullrich · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-32689

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phoenix versions 1.7.0 through 1.7.21 phoenix version 1.8.6

Description An issue in the long-poll transport's NDJSON body handling allows a denial of service. In the publish/4 function of Elixir.Phoenix.Transports.LongPoll, POST requests with Content-Type: application/x-ndjson are processed by splitting the request body on newline characters using String.split/2 without a limit on the resulting segments. An attacker can send a body composed of newline bytes, creating a massive list of empty binaries that exhausts BEAM memory and schedulers, leading to a node crash and termination of all active sessions. The session token needed for the endpoint is obtainable via an unauthenticated GET request with a matching Origin header, making the attack effectively unauthenticated.

Recommendations Update versions 1.7.0 through 1.7.21 to version 1.7.22. Update version 1.8.6 to a newer version. Disable the longpoll transport on all Phoenix.Socket declarations, including the LiveView /live socket, by removing or setting longpoll: false.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-32689

GHSA-628H-Q48J-JR6Q

Affected Products

Phoenix

References · 7

• https://github.com/phoenixframework/phoenix/security/advisories/GHSA-628h-q48j-jr6q · Vendor Advisory
• https://github.com/phoenixframework/phoenix/commit/1a67c61ff9ce0a7711662ac7354861917a7c80f7 · Patch
• https://github.com/phoenixframework/phoenix/commit/912ea181fd247c21dbcc49fb97d0053b947d81bf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32689 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-32689 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-32689.html · Note
• https://hex.pm/packages/phoenix · Note