CVE-2026-110314

Name of the Vulnerable Software and Affected Versions bandit versions 0.5.1 through 1.13.x

Description An issue in the WebSocket connection handling allows a remote client to continue executing handler code after the server has attempted to stop the connection. This occurs because when a callback returns {:stop, ...}, the Bandit.WebSocket.Connection process enters a :closing state but continues to process incoming data frames and messages. The functions handle frame/3 and handle info/3 do not verify the connection state, allowing frames to reach handle in/2 and messages to reach handle info/2 until the client sends a Close frame, the TCP connection drops, or an idle timeout occurs. This can lead to the bypass of authorization checks in init/1 or the evasion of session terminations such as kicks or bans, potentially allowing unauthorized access to administrative actions.

Recommendations Update bandit to version 1.14.0 or later. As a temporary workaround, mark the WebSock state as stopped whenever a callback returns {:stop, ...}, and ensure handle in/2 and handle info/2 return {:ok, state} without performing any actions while that mark is set.