Denial of Service Vulnerability in Phoenix Framework by Phoenix Framework

CVE-2026-32689

What is CVE-2026-32689?

The Phoenix Framework is vulnerable to a denial of service attack due to improper handling of NDJSON body content in long-poll transport. When a POST request with the content type application/x-ndjson is received, the request body is split into segments without limits. An attacker can exploit this by sending a payload consisting solely of newline characters, causing excessive memory consumption and ultimately crashing the server node. This vulnerability can be triggered by unauthenticated clients, allowing significant resource exhaustion and termination of active sessions.

References