Live › vulnerability › CVE-2026-110314
Go to dashboardAfter a WebSock handler returns a stop tuple, Bandit keeps the connection open and still passes later client frames and messages to the handler. A remote client can therefore trigger handler actions that the server meant to have ended, including admin-only actions if the connection was refused after a failed token check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Elixir applications that run Bandit 0.5.1 through 1.13.x and serve WebSocket endpoints built on WebSock where a handler stops the connection to reject a client, for example after failed authentication. Applications that do not use WebSockets, or that enforce authorization inside each action rather than relying on the stop, are less exposed. unknown for exact exposure beyond this.
No product ranges from the sources yet.
mix deps | grep bandit or check mix.lock for the bandit version in use@behaviour WebSock) that return {:stop, ...} from init/1 or handle_in/2 and rely on it to block later actions1.14.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.
When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.
This issue affects bandit: from 0.5.1 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-110314")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.