Remote Denial of Service Vulnerability in Bandit by Mtrudel

CVE-2026-42786

What is CVE-2026-42786?

A resource allocation vulnerability in Bandit allows unauthenticated remote attackers to cause denial of service through memory exhaustion. The issue arises from the handling of continuation frames in the WebSocket connection, leading to unlimited growth of the per-connection data structure. This flaw permits an adversary to stream a potentially endless sequence of frames, consuming memory unmonitored until the process is terminated by the operating system. Affected applications using Phoenix Channels and LiveView may be particularly vulnerable as they are exposed upon accepting socket connections.

References