Denial of Service Vulnerability in Bandit WebSocket by Mtrudel

CVE-2026-65623

What is CVE-2026-65623?

A vulnerability exists in the Bandit WebSocket implementation which allows unauthenticated attackers to cause denial of service through CPU exhaustion. This occurs during the reassembly of WebSocket frames, where the system's handling of multiple non-final continuation frames leads to inefficient processing. The algorithm's complexity in managing and measuring the size of accumulated data grows with each new frame, which can be exploited by sending numerous small payload frames. This results in prolonged CPU usage, potentially stalling legitimate requests and disrupting service. The vulnerability affects versions up to and including Bandit 1.11.0, prior to the 1.12.1 patch.

References