Bandit EUVD-2026-109821

Requires only that the Bandit server (versions 1.11.0 up to but not including 1.14.0) accepts WebSocket upgrades, which is the default behavior for Phoenix LiveView and Phoenix Channels applications - no authentication (PR:N), no user interaction, and no non-default configuration are needed to trigger it. The specific prerequisite is a reachable WebSocket endpoint that completes the upgrade; the flaw lives in Bandit.WebSocket.Connection, where max_fragmented_message_size is checked only against accumulated payload bytes while each non-final continuation frame is stored as a separate list cell with no cap on fragment count. The main limiting factor is that the attacker must be able to establish WebSocket connections; the vendor workaround of lowering websocket_options: [max_fragmented_message_size: ...] (e.g. to 65_536) reduces the ceiling but does not eliminate the ~150x per-connection amplification, so upgrading to 1.14.0 is the complete fix.

This is a genuine availability risk but not a drop-everything emergency. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the mechanism: an unauthenticated, network-reachable attacker with low complexity and no user interaction can exhaust server memory, with impact confined to availability (VC:N/VI:N - no data confidentiality or integrity loss). The vuln.today priority is 'this_week' rather than act_now/emergency, which aligns with a resource-exhaustion DoS that has a vendor patch available. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - this is a severity signal (high availability impact, easy to trigger) rather than a confirmed in-the-wild threat. A detailed step-by-step proof-of-concept is published inside the GHSA advisory itself, which materially lowers the barrier to weaponization even though no packaged exploit tool is referenced. Net: a real and easy-to-exploit single-connection memory-amplification DoS (roughly 150x the configured fragment limit, ~1.2-1.4 GB per connection at the 8 MB default) affecting default configurations, warranting prompt patching, but the scope is limited to availability and there is no confidentiality/integrity exposure.

An unauthenticated attacker opens a single WebSocket connection to any Bandit server that accepts upgrades (including Phoenix LiveView/Channels apps on default settings), sends a non-final frame followed by hundreds of thousands of 1-byte continuation frames, and interleaves Ping frames to defeat the idle timeout. Because each tiny fragment costs ~7 bytes on the wire but ~150-170 bytes of BEAM memory, a few megabytes of traffic inflates to tens or hundreds of megabytes of server memory, and sustained or parallel connections drive the node toward memory exhaustion. The GHSA advisory publishes a concrete PoC (500,000 fragments / 3.5 MB of traffic yielding ~82 MB of growth); it is a reproduction recipe and is not verified as packaged working exploit code.