Read the docs
TI-2026-25181 Aliases CVE-2026-32689GHSA-628h-q48j-jr6q

Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix

Priority MEDIUM 44CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling. In 'Elixir.Phoenix.Transports.LongPoll':publish/4, when a POST request is received with Content-Type: application/x-ndjson, the request body is split on newline characters using String.split/2 with no limit on the number of resulting segments. An attacker can send a body consisting entirely of newline bytes, causing a 1:1 amplification into a list of empty binaries — a 1 MB body produces approximately one million list elements, an 8 MB body approximately 8.4 million. Each element is then walked by Enum.map, materializing another list of the same size. This exhausts BEAM memory and schedulers, crashing the node and terminating all active sessions. A session token required to reach the vulnerable endpoint is freely obtainable by any client via an unauthenticated GET request to the same URL with a matching Origin header, making this attack effectively unauthenticated. This issue affects phoenix: from 1.7.0 before 1.7.22 and 1.8.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Fix Fixed phoenix (phoenixframework): 1.7.22, 1.8.6phoenix (Hex): 1.7.22, 1.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
phoenixframeworkphoenix1.7.0 to before 1.7.22; 1.8.0 to before 1.8.61.7.22, 1.8.6Patch availableCNA
—phoenix (Hex)1.7.0 to before 1.7.221.7.22Patch availableGHSA-628h-q48j-jr6q
—phoenix (Hex)1.8.0 to before 1.8.61.8.6Patch availableGHSA-628h-q48j-jr6q
  • phoenix Vendorphoenixframework Affected 1.7.0 to before 1.7.22; 1.8.0 to before 1.8.6 Fixed in 1.7.22, 1.8.6 Patch available CNA
  • phoenix (Hex) Vendor— Affected 1.7.0 to before 1.7.22 Fixed in 1.7.22 Patch available GHSA-628h-q48j-jr6q
  • phoenix (Hex) Vendor— Affected 1.8.0 to before 1.8.6 Fixed in 1.8.6 Patch available GHSA-628h-q48j-jr6q

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*——phoenixframework
  • cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:* Versions — — ·phoenixframework

Remediation

  • Fix · CNA phoenix (phoenixframework) Fixed in 1.7.22, 1.8.6
  • Fix · GHSA-628h-q48j-jr6q phoenix (Hex) Fixed in 1.7.22 Advisory →
  • Fix · GHSA-628h-q48j-jr6q phoenix (Hex) Fixed in 1.8.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32689
  2. 2026-10-03 Alias added: GHSA-628h-q48j-jr6q

References

Patch 2

Advisory 2

Other 3

  • TI-2026-40965 Improper check for unusual conditions in phoenixframework phoenix CVSS 4.0MEDIUM 6.3
  • TI-2026-41931 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link> CVSS 4.0MEDIUM 5.1
  • TI-2026-40964 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service CVSS 4.0HIGH 8.7
  • TI-2026-46420 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR CVSS 4.0LOW 2.1
  • TI-2022-20955 socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. CVSS 3.1HIGH 7.5
  • TI-2017-14495 The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and… CVSS 3.0MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences