Loading story…
Two high-severity denial-of-service vulnerabilities have been disclosed in mtrudel Bandit that let unauthenticated remote attackers exhaust server memory through WebSocket handling. CVE-2026-42786 affects Bandit versions 0.5.0 before 1.11.0 and stems from unbounded accumulation of fragmented WebSocket continuation frames in Elixir.Bandit.WebSocket.Connection.handle_frame/3; Bandit appends fragments to a per-connection iolist without any cumulative size limit, so an attacker can keep sending fin: false frames until the BEAM node runs out of memory. The issue occurs before WebSock.handle_in/2 is reached, preventing application-level checks from stopping the buildup, and it can expose Phoenix Channels and LiveView deployments that accept socket connections.
A second flaw, CVE-2026-39804, affects Bandit versions 0.5.9 before 1.11.0 and is caused by unbounded decompression in Elixir.Bandit.WebSocket.PerMessageDeflate:inflate/2, where :zlib.inflate/2 is used without an output-size cap before the payload is converted into a single binary. A small compressed WebSocket frame can therefore trigger massive memory allocation and potentially an out-of-memory kill before application code executes. This issue is limited to deployments that enable WebSocket compression at both the Bandit server level (websocket_options.compress) and during upgrade (compress: true in WebSockAdapter.upgrade/4); stock Phoenix and LiveView defaults are reported as unaffected because compression is disabled by default.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-39804 was recorded as a high-severity denial-of-service flaw in Elixir.Bandit.WebSocket.PerMessageDeflate:inflate/2. When Bandit's WebSocket compression is enabled, a small compressed frame can decompress into a massive payload and exhaust memory before application code runs.
CVE-2026-42786 was recorded as a high-severity denial-of-service flaw in Elixir.Bandit.WebSocket.Connection.handle_frame/3. An unauthenticated remote attacker can send unlimited continuation frames with fin: false to force unbounded memory allocation before application-level checks occur.
Two denial-of-service vulnerabilities affecting mtrudel Bandit were disclosed as fixed in Bandit 1.11.0: one involving unbounded WebSocket fragmented-message reassembly and another involving unbounded permessage-deflate decompression. The issues affect Bandit versions before 1.11.0, with impacted ranges starting at 0.5.0 for fragmented reassembly and 0.5.9 for permessage-deflate inflation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, `CVE-2026-33013` affects versions before `4.10.16` and `3.10.5` and is caused by improper handling of descending array indices during `application/x-www-form-urlencoded` body binding in `JsonBeanPropertyBinder::expandArrayToThreshold`. A crafted request using indexed parameters such as `authors[1].name` followed by `authors[0].name` can trigger a non-terminating loop, CPU exhaustion, and an `OutOfMemoryError`. Netty separately patched `CVE-2026-33871`, a denial-of-service flaw in HTTP/2 processing that affects versions before `4.1.132.Final` and `4.2.10.Final`. The bug lets attackers flood servers with `CONTINUATION` frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as `CWE-835` in Micronaut and `CWE-770` in Netty, and both vendors released fixed versions for affected branches.
Jun 29, 2026
Erlang/OTP users were urged to patch after multiple vulnerabilities were disclosed across the platform, including high-severity flaws that can crash BEAM nodes or exhaust resources during normal protocol handling. **CVE-2026-59251** affects `public_key` certificate path validation, where a crafted X.509 chain can trigger exponential certificate policy tree growth during a TLS handshake and consume CPU and memory until the VM fails. **CVE-2026-58227** affects the `ssl` application, where mutually cross-signed certificates can cause unbounded recursion while rebuilding incomplete TLS or DTLS peer chains, allowing an unauthenticated attacker to crash either servers or clients before authentication completes. A separate high-severity flaw, **CVE-2026-54890**, impacts the `erts` External Term Format decoder used by `binary_to_term/1`, `binary_to_term/2`, and `enif_binary_to_term()`, where an integer underflow in `BIT_BINARY_EXT` decoding can trigger near-`2^64` memory allocation and terminate the entire Erlang VM. National cyber authorities in Canada and Italy published advisories directing administrators to review Erlang security bulletins and update affected releases, while the Italian notice said the broader disclosure set includes additional Erlang/OTP issues spanning denial of service, remote code execution, authentication bypass, and security feature bypass. Fixed versions cited across the disclosures include **27.3.4.15**, **28.5.0.4**, and **29.0.4**.
Jul 29, 2026
Red Hat addressed **CVE-2014-0193**, a low-severity denial-of-service flaw in Netty's `WebSocket08FrameDecoder`. An unauthenticated remote attacker could send a sequence of `TextWebSocketFrame` and `ContinuationWebSocketFrame` messages that caused uncontrolled memory aggregation, resulting in an `OutOfMemoryException` and potentially crashing or degrading an affected server. Netty fixed the issue in its 3.x and 4.x branches; Netty 3.2.x was not affected because it lacked the vulnerable WebSocket implementation. The remediation was delivered to affected JBoss products through Red Hat security advisories, including **RHSA-2014:1020** for JBoss EAP 6. Red Hat updated Netty to `netty-3.6.9-1.Final_redhat_1.1.ep6.el6`, incorporating upstream commit `4cc400ce2145a72820119b0eaab838d5d9263022`, and verified the fix in EAP 6.3.0.ER10. Organizations operating affected JBoss deployments should apply the relevant Red Hat errata and verify that bundled Netty components are updated.
Aug 31, 2026