Phoenix Framework EUVD-2026-42049

The target endpoint must mount a Phoenix socket (Phoenix.Socket) that exposes a reachable channel transport - either WebSocket or LongPoll - to the attacker; endpoints without a mounted channel-capable socket are not affected. Given AV:N/AC:L/AT:N/PR:N/UI:N, there is no authentication, user interaction, or special configuration barrier on a default channel-enabled deployment: a single unauthenticated client can trigger it. The key limiting factor is exposure - only applications that actually serve Phoenix channels over WebSocket/LongPoll to untrusted networks are exploitable - and the affected version must be pre-1.5.15/1.6.17/1.7.24/1.8.9; note that once patched, the :max_channels_per_transport default of 100 caps the abuse. Standard network-layer defenses (per-IP connection caps, connection rate limiting) do NOT limit exploitation because the amplification occurs inside one connection.

The signals are internally consistent for a high-impact availability bug. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms remote, unauthenticated, no-interaction exploitation with high availability impact and no confidentiality or integrity impact, yielding the 8.7 score. There is no CISA KEV listing and no POC referenced, so this is not confirmed actively exploited - treat it as a real, easily-triggered DoS rather than an in-the-wild threat. The notable amplifying factor, called out by the vendor, is that the attack happens inside one connection, so conventional per-IP connection caps and network-layer rate limiting do NOT mitigate it - this raises real-world priority above a typical volumetric DoS for anyone exposing Phoenix channels to untrusted clients. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted; prioritize based on the ease of exploitation and public-facing exposure of the socket endpoint instead.

An unauthenticated attacker opens a single WebSocket (or LongPoll) connection to a public Phoenix endpoint that mounts a socket, then rapidly streams phx_join messages down that one connection, each spawning a persistent channel process. Within one connection the attacker spawns hundreds of thousands of processes until the BEAM process table is exhausted, at which point the node can no longer start processes and service is denied to all legitimate users. No exploit code was referenced in the provided data, but the single-connection amplification means the attack requires only trivial scripting and bypasses connection-count rate limits.