Read the docs
TI-2026-28687 Aliases CVE-2026-39804GHSA-frh3-6pv6-rc8j

WebSocket permessage-deflate inflate has no output-size cap in bandit

Priority HIGH 75CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs. An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill. This vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false. This issue affects bandit: from 0.5.9 before 1.11.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00759 55th percentileScored 2026-11-08
Fix Fixed bandit (mtrudel): 1.11.0bandit (Hex): 1.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mtrudelbandit0.5.9 to before 1.11.01.11.0Patch availableCNA
—bandit (Hex)0.5.8 to before 1.11.01.11.0Patch availableGHSA-frh3-6pv6-rc8j
  • bandit Vendormtrudel Affected 0.5.9 to before 1.11.0 Fixed in 1.11.0 Patch available CNA
  • bandit (Hex) Vendor— Affected 0.5.8 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-frh3-6pv6-rc8j

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*——mtrudel
  • cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:* Versions — — ·mtrudel

Remediation

  • Fix · CNA bandit (mtrudel) Fixed in 1.11.0
  • Fix · GHSA-frh3-6pv6-rc8j bandit (Hex) Fixed in 1.11.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    mtrudel bandit 1.11.0

    5 records Highest priority Priority HIGH 5 HIGH

    Other records, highest priority first

    • TI-2026-31007 WebSocket fragmented message reassembly unbounded in banditPriority HIGH 77
    • TI-2026-31008 HTTP/2 frame size limit checked after body is buffered in banditPriority HIGH 70
    • TI-2026-28690 Client-supplied URI scheme trusted without transport verification in banditPriority HIGH 67
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39804
  2. 2026-10-03 Alias added: GHSA-frh3-6pv6-rc8j
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 3

  • TI-2026-81989 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit CVSS 4.0HIGH 8.7
  • TI-2026-74311 Bandit HTTP/2 send timers reset, letting trickles pin stream processes CVSS 4.0HIGH 8.7
  • TI-2026-52571 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit CVSS 4.0HIGH 8.7
  • TI-2026-46780 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit CVSS 4.0HIGH 8.7
  • TI-2026-31007 WebSocket fragmented message reassembly unbounded in bandit CVSS 4.0HIGH 8.7
  • TI-2026-28689 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit CVSS 4.0HIGH 8.7
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences