{"id":"CVE-2026-110314","kind":"vulnerability","aliases":["CVE-2026-110314"],"related":[],"title":"Bandit: WebSocket handlers keep running after server closes connection","description":"Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.\n\nWhen a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.\n\nThis issue affects bandit: from 0.5.1 before 1.14.0.","summary":"After a WebSock handler returns a stop tuple, Bandit keeps the connection open and still passes later client frames and messages to the handler. A remote client can therefore trigger handler actions that the server meant to have ended, including admin-only actions if the connection was refused after a failed token check.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bandit","elixir","phoenix","runtime","websocket"],"not_affected_if":["bandit-1.14-or-later","no-websockets"],"how_to_check":"- Run `mix deps | grep bandit` or check `mix.lock` for the bandit version in use\n- Search the app for WebSock modules (`@behaviour WebSock`) that return `{:stop, ...}` from init/1 or handle_in/2 and rely on it to block later actions","fix":"- Upgrade bandit to `1.14.0` or later","status":"open","published_at":"2026-10-26T14:16:25+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:39+00:00","updated_at":"2026-10-26T14:32:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-26T14:32:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bandit to `1.14.0` or later","reach":"internet","title":"Bandit: WebSocket handlers keep running after server closes connection","impact":"medium","summary":"After a WebSock handler returns a stop tuple, Bandit keeps the connection open and still passes later client frames and messages to the handler. A remote client can therefore trigger handler actions that the server meant to have ended, including admin-only actions if the connection was refused after a failed token check.","category":"runtime","nicknames":[],"who_cares":["elixir","bandit","phoenix","websocket"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A rejected client keeps running handler actions, possibly admin-only ones.","analyst_note":"","how_to_check":"- Run `mix deps | grep bandit` or check `mix.lock` for the bandit version in use\n- Search the app for WebSock modules (`@behaviour WebSock`) that return `{:stop, ...}` from init/1 or handle_in/2 and rely on it to block later actions","needs_analyst":false,"not_affected_if":["no-websockets","bandit-1.14-or-later"],"who_is_affected":"Elixir applications that run Bandit 0.5.1 through 1.13.x and serve WebSocket endpoints built on WebSock where a handler stops the connection to reject a client, for example after failed authentication. Applications that do not use WebSockets, or that enforce authorization inside each action rather than relying on the stop, are less exposed. unknown for exact exposure beyond this.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3518,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110314':12A,15A '-2026':11A,14A '0.5.1':212C '1.14.0':214C 'action':52B,64B,206C 'admin':62B,204C 'admin-on':61B,203C 'affect':209C 'allow':93C 'bandit':1A,16B,29B,92C,210C 'bandit.websocket.connection':127C 'call':128C 'callback':124C 'check':74B,154C,198C 'client':38B,47B,76C,96C,179C,190C 'client-sid':75C 'close':8A,119C,131C,146C,181C 'code':102C 'connect':9A,32B,67B,88C,109C,141C 'could':199C 'cve':10A,13A 'data':111C 'drop':183C 'elixir':17B 'end':59B 'enforc':78C 'fail':72B,196C 'fire':188C 'frame':39B,112C,120C,159C 'frame/3':149C 'handl':89C,148C,151C,162C,168C 'handler':3A,24B,44B,51B,101C 'idl':186C 'ignor':115C 'in/2':163C 'includ':60B 'info/2':169C 'info/3':152C 'init/1':193C 'issu':208C 'keep':4A,30B,98C,139C 'later':37B,158C,165C 'meant':56B 'messag':41B,166C 'mtrudel':91C 'never':153C 'open':33B 'pass':36B 'phoenix':18B 'process':142C 'reach':161C,167C 'refus':69B,191C 'remot':46B,95C 'return':25B,125C 'run':5A,99C,143C,201C 'runtim':19B 'secur':83C 'send':130C,180C 'sent':113C 'server':7A,55B,81C,105C,117C 'server-sid':80C 'shut':133C 'side':77C,82C,137C 'state':147C,156C,172C 'still':35B,160C,200C 'stop':27B,107C,126C,175C 'tcp':182C 'terminate/2':129C 'therefor':49B 'timeout':187C 'token':73B,197C 'trigger':50B 'tupl':28B,176C 'via':110C 'vulner':84C 'websock':23B,100C,123C 'websocket':2A,20B,87C 'write':136C","nicknames":[],"mitigations":[],"who_affected":"Elixir applications that run Bandit 0.5.1 through 1.13.x and serve WebSocket endpoints built on WebSock where a handler stops the connection to reject a client, for example after failed authentication. Applications that do not use WebSockets, or that enforce authorization inside each action rather than relying on the stop, are less exposed. unknown for exact exposure beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110314","severity":null,"published_at":"2026-10-26T14:16:25+00:00","modified_at":"2026-10-26T14:16:25+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}