Live › vulnerability › CVE-2026-114213
Go to dashboardBandit, an Elixir HTTP server, keeps each 1-byte WebSocket continuation fragment as its own list cell, so one connection can hold about 150 times the configured fragment size limit in memory. An unauthenticated remote attacker can exhaust server memory, roughly 1.2 to 1.4 GB at the default 8 MB limit, and keep the connection alive with ping frames.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications that run the mtrudel bandit HTTP server at versions from 1.11.0 up to but not including 1.14.0 and accept WebSocket connections from untrusted clients. Apps that do not serve WebSockets through Bandit, or that sit behind a proxy that rejects fragmented WebSocket messages, are less exposed. The sources do not say whether a proxy in front of Bandit blocks this pattern.
No product ranges from the sources yet.
mix deps | grep bandit or check mix.lock for the bandit version in useWebSock or Plug upgrades)max_fragmented_message_size is set in the Bandit WebSocket options1.14.0 or latermix.lock and redeploy the releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames.
Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout.
This issue affects bandit: from 1.11.0 before 1.14.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114213")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.