CVE-2026-39804
HighSummary
CVE-2026-39804 vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion when permessage-deflate compression is enabled in WebSocket. An unauthenticated attacker can send a specially crafted frame, leading to an out-of-memory kill.
Risk Assessment
The organization is at risk of attacks that can lead to complete service outages related to the application, potentially resulting in significant financial and reputational losses.
Recommendation
It is recommended to disable permessage-deflate compression in WebSocket or implement limits on decompressed output size to minimize the risk of memory exhaustion.
Other vulnerabilities in mtrudel bandit
See all- CVE-2026-39806High
CVE-2026-39806 vulnerability in mtrudel bandit allows remote denial of service via worker process exhaustion. The issue occurs in the do_read_chunked_data!/5 function, which does not terminate correctly when trailer fields are present in chunked requests.
- CVE-2026-39803High
CVE-2026-39803 in mtrudel bandit has a resource allocation without limits vulnerability that allows unauthenticated remote denial of service via memory exhaustion. The do_read_chunked_data!/5 function does not cap the size of buffered data, leading to memory overflow.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled. 'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs. An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill. This vulnerability requires both Bandit's server-level