CVE-2026-65623

Name of the Vulnerable Software and Affected Versions bandit versions 1.11.0 through 1.12.0

Description An inefficient algorithmic complexity issue allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The function oversize message?/2, called from handle frame/3 in lib/bandit/websocket/connection.ex, appends non-final continuation frames to a left-nested iolist and re-measures the entire buffer using IO.iodata length/1 for every frame. This results in quadratic (O(n^2)) reassembly work relative to the number of continuation frames. While the max fragmented message size limit restricts total bytes, it does not limit the frame count. An attacker can send numerous small continuation frames to exhaust CPU resources, potentially starving the server and denying service to legitimate users. This issue specifically affects applications serving WebSocket endpoints through Bandit, including Phoenix applications using Bandit as the HTTP adapter.

Recommendations Update bandit to version 1.12.1.