Denial of Service Vulnerability in Bandit WebSocket by mtrudel

CVE-2026-39804

What is CVE-2026-39804?

A vulnerability in Bandit, developed by mtrudel, allows attackers to exploit unauthenticated WebSocket connections to trigger memory exhaustion. When compression via permessage-deflate is enabled, an unauthenticated user can send specially crafted frames that exploit the lack of output-size restrictions during decompression. This can result in significant memory allocation, exceeding the available heap and potentially causing an out-of-memory (OOM) condition in the BEAM virtual machine. To be vulnerable, specific server options must be enabled, including websocket_options.compress. Affected versions range from 0.5.9 to earlier than 1.11.0.

References