CVE-2026-65623
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Inefficient algorithmic complexity vulnerability in the bandit library (Elixir), allowing unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.
Risk Assessment
An attacker can pin a CPU core for extended periods, and many concurrent connections can starve the server of CPU, denying service to legitimate users.
Recommendation
Update bandit to version 1.12.1 or later, which contains the fix.
Other vulnerabilities in bandit
See all- CVE-2026-42786High
A vulnerability in mtrudel bandit allows for remote denial of service via memory exhaustion, enabling unauthorized users to send an unbounded number of continuation frames. The issue occurs in the handle_frame/3 method, which lacks size limits for accumulated data.
- CVE-2026-75484Medium
CRLF Injection vulnerability in the Bandit library allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Header validation does not check field values, allowing them to pass through unchanged. Additionally, a duplicate :authority pseudo-header is accepted, which can lead to conflicts.
- CVE-2026-74836High
A vulnerability in the Bandit library (Elixir) allows an unauthenticated attacker to pin an unbounded number of HTTP/2 stream processes via connection-level flow control. When a response exceeds the connection send window (default 65,535 bytes), the stream process blocks forever, and the queue is never purged, leading to resource exhaustion.
- CVE-2026-39805Medium
A vulnerability in the Bandit library (Elixir) allows HTTP request smuggling via duplicate Content-Length headers. The server accepts the first header and treats the remaining data as a subsequent request on the same connection.
Original NVD description (English source)
Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames. The max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback. This issue affects bandit: from 1.11.0 before 1.12.1.