CVE-2026-39804

{
  "id": "CVE-2026-39804",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-01T21:16:16.853",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.\n\n'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.\n\nAn unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.\n\nThis vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.\n\nThis issue affects bandit: from 0.5.9 before 1.11.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignación de recursos sin límites ni limitación en mtrudel bandit permite la denegación de servicio remota no autenticada a través del agotamiento de la memoria cuando la compresión WebSocket permessage-deflate está habilitada.\n\n’Elixir.Bandit.WebSocket.PerMessageDeflate’:inflate/2 en lib/bandit/websocket/permessage_deflate.ex llama a :zlib.inflate/2 sin límite de tamaño de salida, luego materializa la carga útil descomprimida completa como un único binario a través de IO.iodata_to_binary/1. La opción websocket_options.max_frame_size solo limita el tamaño del marco en tránsito (comprimido), no la salida descomprimida. Un marco comprimido de alta relación (por ejemplo, datos uniformes con una relación de ~1024:1) puede permanecer muy por debajo de cualquier límite de tamaño de cable mientras fuerza asignaciones de pila a escala de GiB en el proceso de conexión antes de que se ejecute cualquier código de aplicación.\n\nUn atacante no autenticado que puede abrir una conexión WebSocket puede enviar un único marco de este tipo para agotar la memoria del nodo BEAM y activar una eliminación por OOM.\n\nEsta vulnerabilidad requiere que tanto la opción websocket_options.compress a nivel de servidor de Bandit como la opción compress: true por actualización pasada a WebSockAdapter.upgrade/4 estén habilitadas. Las aplicaciones estándar de Phoenix y LiveView no se ven afectadas ya que por defecto tienen compress: false.\n\nEste problema afecta a bandit: desde 0.5.9 antes de 1.11.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "mtrudel",
          "product": "bandit",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "bandit",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Bandit.WebSocket.PerMessageDeflate'"
          ],
          "programFiles": [
            "lib/bandit/websocket/permessage_deflate.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"
            }
          ],
          "repo": "https://github.com/mtrudel/bandit",
          "packageURL": "pkg:hex/bandit",
          "versions": [
            {
              "version": "0.5.9",
              "lessThan": "1.11.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "mtrudel",
          "product": "bandit",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "mtrudel/bandit",
          "cpes": [
            "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Bandit.WebSocket.PerMessageDeflate'"
          ],
          "programFiles": [
            "lib/bandit/websocket/permessage_deflate.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"
            }
          ],
          "repo": "https://github.com/mtrudel/bandit",
          "packageURL": "pkg:github/mtrudel/bandit",
          "versions": [
            {
              "version": "da4027cff7d2b80319e76fe7a32f84beceec490a",
              "lessThan": "8156921a51e684a951221da7bc30a70a022f722e",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-02T01:19:00.687361Z",
          "id": "CVE-2026-39804",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-39804.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39804",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}