Phoenixframework
Monthly
Denial of service in the Phoenix Framework (Elixir) affects any endpoint mounting a Phoenix.Socket with a reachable WebSocket or LongPoll channel transport, in versions from 0.11.0 up to the fixed 1.5.15, 1.6.17, 1.7.24, and 1.8.9. Because transports place no cap on channels joined per connection, one unauthenticated client can stream unlimited phx_join messages down a single connection to spawn hundreds of thousands of channel processes and exhaust the BEAM process table, taking the whole node offline. Rated CVSS 4.0 8.7 (availability-only impact); no public exploit identified at time of analysis, though the mechanics are described in detail in the vendor advisory.
Unauthenticated remote denial-of-service in Phoenix Framework 1.7.0-1.7.21 and 1.8.0-1.8.5 allows attackers to crash Elixir BEAM nodes by sending multi-megabyte HTTP requests filled with newlines to the long-poll transport endpoint. A 1 MB payload of newline characters triggers allocation of approximately one million empty list elements, exhausting scheduler and memory resources. Session token required to trigger the vulnerability is obtainable via unauthenticated GET request, making exploitation trivial. Vendor-released patches (1.7.22, 1.8.6) enforce client-side batching limits. CVSS 8.7 (high availability impact) confirmed; no public exploit or CISA KEV listing identified at time of analysis.
Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.
URL scheme validation bypass in Phoenix LiveView 1.2.2–1.2.6 allows unauthenticated attackers to inject javascript: URLs that execute in a victim's browser session when clicked. The root cause is a first-byte ASCII letter guard in the internal uri_scheme/1 helper: inputs prefixed with whitespace or C0 control characters bypass scheme detection entirely and are treated as safe relative paths, while WHATWG-compliant browsers silently strip those leading bytes before parsing — converting what LiveView sees as a harmless string into an executable javascript: URL. Applications rendering user-supplied URLs (profile links, redirect targets, external references) via the <.link href={...}> component are directly affected; no public exploit code has been identified at time of analysis, and a patched release (1.2.7) is available.
Phoenix Framework's Presence JavaScript client allows any user with ordinary channel access to permanently break presence synchronization for all other viewers of an affected channel topic. By joining a channel using a key name that collides with an Object.prototype property (such as '__proto__', 'constructor', or 'toString'), an attacker causes an uncaught TypeError inside Presence.syncState and Presence.syncDiff that halts all further presence updates for every connected viewer until the attacker disconnects. This is not in CISA KEV, no public exploit has been identified, and the CVSS 4.0 score of 6.3 reflects the limited but persistent client-side availability impact with no server-side exposure.
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in the Phoenix Framework (Elixir) affects any endpoint mounting a Phoenix.Socket with a reachable WebSocket or LongPoll channel transport, in versions from 0.11.0 up to the fixed 1.5.15, 1.6.17, 1.7.24, and 1.8.9. Because transports place no cap on channels joined per connection, one unauthenticated client can stream unlimited phx_join messages down a single connection to spawn hundreds of thousands of channel processes and exhaust the BEAM process table, taking the whole node offline. Rated CVSS 4.0 8.7 (availability-only impact); no public exploit identified at time of analysis, though the mechanics are described in detail in the vendor advisory.
Unauthenticated remote denial-of-service in Phoenix Framework 1.7.0-1.7.21 and 1.8.0-1.8.5 allows attackers to crash Elixir BEAM nodes by sending multi-megabyte HTTP requests filled with newlines to the long-poll transport endpoint. A 1 MB payload of newline characters triggers allocation of approximately one million empty list elements, exhausting scheduler and memory resources. Session token required to trigger the vulnerability is obtainable via unauthenticated GET request, making exploitation trivial. Vendor-released patches (1.7.22, 1.8.6) enforce client-side batching limits. CVSS 8.7 (high availability impact) confirmed; no public exploit or CISA KEV listing identified at time of analysis.
Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.
URL scheme validation bypass in Phoenix LiveView 1.2.2–1.2.6 allows unauthenticated attackers to inject javascript: URLs that execute in a victim's browser session when clicked. The root cause is a first-byte ASCII letter guard in the internal uri_scheme/1 helper: inputs prefixed with whitespace or C0 control characters bypass scheme detection entirely and are treated as safe relative paths, while WHATWG-compliant browsers silently strip those leading bytes before parsing — converting what LiveView sees as a harmless string into an executable javascript: URL. Applications rendering user-supplied URLs (profile links, redirect targets, external references) via the <.link href={...}> component are directly affected; no public exploit code has been identified at time of analysis, and a patched release (1.2.7) is available.
Phoenix Framework's Presence JavaScript client allows any user with ordinary channel access to permanently break presence synchronization for all other viewers of an affected channel topic. By joining a channel using a key name that collides with an Object.prototype property (such as '__proto__', 'constructor', or 'toString'), an attacker causes an uncaught TypeError inside Presence.syncState and Presence.syncDiff that halts all further presence updates for every connected viewer until the attacker disconnects. This is not in CISA KEV, no public exploit has been identified, and the CVSS 4.0 score of 6.3 reflects the limited but persistent client-side availability impact with no server-side exposure.
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.