Bandit: Resource exhaustion via unlimited WebSocket continuation frames
Summary
Bandit, an Elixir HTTP and WebSocket server, does not limit the number of continuation frames in a fragmented WebSocket message, and its size limit counts only payload bytes. An unauthenticated remote attacker can send many 1-byte fragments over one connection and exhaust server memory, with an estimated 1.2 to 1.4 GB per connection at the default 8 MB limit. Ping frames between fragments keep the connection alive past the idle timeout. Any Bandit server that accepts WebSocket upgrades with default settings, including Phoenix LiveView and Channels applications, is affected.
Affected
- bandit from 1.11.0 before 1.14.0
- Default configuration is affected once WebSocket upgrades are accepted
Fixed in
- Upgrade to bandit 1.14.0 or later
Workaround
- Lower websocket_options max_fragmented_message_size to the largest fragmented message the application needs, for example 65536
- This only lowers the memory ceiling per connection; it does not remove the issue, so upgrading is the fix
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No evidence of exploitation in the wild found
- No public proof of concept for this CVE found; the reporter's own test showed about 82 MB of memory growth for 3.5 MB of traffic
Our recommendation
- Check dependencies (mix.lock) for bandit, including Phoenix applications
- Upgrade bandit to 1.14.0 or later
- Until the upgrade, lower max_fragmented_message_size for WebSocket endpoints and consider rate limiting or proxy restrictions on WebSocket upgrades
- Monitor BEAM memory usage for unusual growth
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA EEF) cna.erlef.org
- GitHub Security Advisory GHSA-cpx7-qf6w-jc63 github.com
- OSV record EEF-CVE-2026-114213 osv.dev
- Fix commit 220b9df in mtrudel/bandit github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:11.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout. This issue affects bandit: from 1.11.0 before 1.14.0.
NVD references (5)
- https://cna.erlef.org/cves/CVE-2026-114213.html
- https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/security/advisories/GHSA-cpx7-qf6w-jc63
- https://osv.dev/vulnerability/EEF-CVE-2026-114213
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.