Denial of Service Vulnerability in Phoenix Framework Affecting Unauthenticated Socket Connections

CVE-2026-56811

What is CVE-2026-56811?

The vulnerability in the Phoenix Framework's Socket module allows an unauthenticated attacker to launch a Denial of Service attack against any endpoint using Phoenix sockets. By sending numerous 'phx_join' messages over a single WebSocket or LongPoll connection, an attacker can overwhelm the server by creating excessive channel processes. This can lead to the exhaustion of the maximum process limit on the BEAM virtual machine, causing legitimate traffic to be denied service. The issue arises from the lack of limits on the number of channels a single transport process can join, making it easy for attackers to exploit this flaw. A fix has been implemented, which adds a 'max_channels_per_transport' option to constrain channel joining, thereby improving the security of the framework.

References