mtrudel bandit up to 1.10.x permessage_deflate.ex Elixir.Bandit.WebSocket.PerMessageDeflate allocation of resources

Summaryinfo

A vulnerability categorized as problematic has been discovered in mtrudel bandit up to 1.10.x. Affected is the function Elixir.Bandit.WebSocket.PerMessageDeflate in the library lib/bandit/websocket/permessage_deflate.ex. Such manipulation leads to allocation of resources. This vulnerability is listed as CVE-2026-39804. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in mtrudel bandit up to 1.10.x and classified as problematic. Affected by this issue is the function Elixir.Bandit.WebSocket.PerMessageDeflate in the library lib/bandit/websocket/permessage_deflate.ex. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. CVE summarizes:

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs. An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill. This vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false. This issue affects bandit: from 0.5.9 before 1.11.0.

The weakness was presented by Peter Ullrich as GHSA-frh3-6pv6-rc8j. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-39804 since 04/07/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.11.0 eliminates this vulnerability. Applying the patch 8156921a51e684a951221da7bc30a70a022f722e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-26711). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• mtrudel

Name

• bandit

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10

License

• open-source

Website

• Product: https://github.com/mtrudel/bandit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion