CVE-2026-114213

Name of the Vulnerable Software and Affected Versions bandit versions 1.11.0 through 1.13.x

Description An unauthenticated remote attacker can exhaust server memory through the WebSocket fragment reassembly process. The Bandit.WebSocket.Connection function checks the max fragmented message size variable against the received payload bytes but does not limit the total number of fragments. By sending a fragmented message consisting of numerous 1-byte continuation frames, an attacker can consume significantly more memory than the configured limit. For instance, a 1-byte fragment requires approximately 150 to 170 bytes of server memory. Additionally, sending Ping frames between fragments allows the connection to remain active beyond the idle timeout.

Recommendations Update bandit to version 1.14.0 or later. As a temporary mitigation, lower the websocket options: [max fragmented message size: ...] setting to the minimum size required by the application, such as 65 536, to reduce the potential memory consumption per connection.