CVE-2026-39804

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39804", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-04-07T12:28:54.916Z", "datePublished": "2026-05-01T20:34:24.604Z", "dateUpdated": "2026-05-27T15:41:26.362Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.11.0", "status": "affected", "version": "0.5.9", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "8156921a51e684a951221da7bc30a70a022f722e", "status": "affected", "version": "da4027cff7d2b80319e76fe7a32f84beceec490a", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability is only reachable when both of the following conditions are true:<ul><li>Bandit's server-level <tt>websocket_options.compress</tt> is enabled (it defaults to <tt>true</tt>).</li><li>The per-upgrade <tt>compress: true</tt> option is passed to <tt>WebSockAdapter.upgrade/4</tt> (it defaults to <tt>false</tt>; Phoenix's default is also <tt>false</tt>).</li></ul>Stock Phoenix and LiveView applications are not affected because <tt>compress: false</tt> is their default."}], "value": "The vulnerability is only reachable when both of the following conditions are true:\n- Bandit's server-level websocket_options.compress is enabled (it defaults to true).\n- The per-upgrade compress: true option is passed to WebSockAdapter.upgrade/4 (it defaults to false; Phoenix's default is also false).\n\nStock Phoenix and LiveView applications are not affected because compress: false is their default."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.11.0", "versionStartIncluding": "0.5.9", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.<p><tt>'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2</tt> in <tt>lib/bandit/websocket/permessage_deflate.ex</tt> calls <tt>:zlib.inflate/2</tt> with no output-size cap, then materializes the entire decompressed payload as a single binary via <tt>IO.iodata_to_binary/1</tt>. The <tt>websocket_options.max_frame_size</tt> option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.</p><p>An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.</p><p>This vulnerability requires both Bandit's server-level <tt>websocket_options.compress</tt> and the per-upgrade <tt>compress: true</tt> option passed to <tt>WebSockAdapter.upgrade/4</tt> to be enabled. Stock Phoenix and LiveView applications are not affected as they default to <tt>compress: false</tt>.</p><p>This issue affects bandit: from 0.5.9 before 1.11.0.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.\n\n'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.\n\nAn unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.\n\nThis vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.\n\nThis issue affects bandit: from 0.5.9 before 1.11.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:26.362Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-39804.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39804"}, {"tags": ["patch"], "url": "https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e"}], "source": {"discovery": "EXTERNAL"}, "title": "WebSocket permessage-deflate inflate has no output-size cap in bandit", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Do not pass <tt>compress: true</tt> to <tt>WebSockAdapter.upgrade/4</tt>. Omitting this option (or setting it to <tt>false</tt>) prevents permessage-deflate from being negotiated, so the inflate path is never reached."}], "value": "Do not pass compress: true to WebSockAdapter.upgrade/4. Omitting this option (or setting it to false) prevents permessage-deflate from being negotiated, so the inflate path is never reached."}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-02T01:19:00.687361Z", "id": "CVE-2026-39804", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-02T01:19:55.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39804", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-02T01:19:00.687361Z"}}}], "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-02T01:19:30.826Z"}}], "cna": {"title": "WebSocket permessage-deflate inflate has no output-size cap in bandit", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Mat Trudel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "product": "bandit", "versions": [{"status": "affected", "version": "0.5.9", "lessThan": "1.11.0", "versionType": "semver"}], "packageURL": "pkg:hex/bandit", "packageName": "bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}]}, {"cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "product": "bandit", "versions": [{"status": "affected", "version": "da4027cff7d2b80319e76fe7a32f84beceec490a", "lessThan": "8156921a51e684a951221da7bc30a70a022f722e", "versionType": "git"}], "packageURL": "pkg:github/mtrudel/bandit", "packageName": "mtrudel/bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}]}], "references": [{"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-39804.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-39804", "tags": ["related"]}, {"url": "https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Do not pass compress: true to WebSockAdapter.upgrade/4. Omitting this option (or setting it to false) prevents permessage-deflate from being negotiated, so the inflate path is never reached.", "supportingMedia": [{"type": "text/html", "value": "Do not pass <tt>compress: true</tt> to <tt>WebSockAdapter.upgrade/4</tt>. Omitting this option (or setting it to <tt>false</tt>) prevents permessage-deflate from being negotiated, so the inflate path is never reached.", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.\n\n'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.\n\nAn unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.\n\nThis vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.\n\nThis issue affects bandit: from 0.5.9 before 1.11.0.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.<p><tt>'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2</tt> in <tt>lib/bandit/websocket/permessage_deflate.ex</tt> calls <tt>:zlib.inflate/2</tt> with no output-size cap, then materializes the entire decompressed payload as a single binary via <tt>IO.iodata_to_binary/1</tt>. The <tt>websocket_options.max_frame_size</tt> option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.</p><p>An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.</p><p>This vulnerability requires both Bandit's server-level <tt>websocket_options.compress</tt> and the per-upgrade <tt>compress: true</tt> option passed to <tt>WebSockAdapter.upgrade/4</tt> to be enabled. Stock Phoenix and LiveView applications are not affected as they default to <tt>compress: false</tt>.</p><p>This issue affects bandit: from 0.5.9 before 1.11.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "configurations": [{"lang": "en", "value": "The vulnerability is only reachable when both of the following conditions are true:\n- Bandit's server-level websocket_options.compress is enabled (it defaults to true).\n- The per-upgrade compress: true option is passed to WebSockAdapter.upgrade/4 (it defaults to false; Phoenix's default is also false).\n\nStock Phoenix and LiveView applications are not affected because compress: false is their default.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability is only reachable when both of the following conditions are true:<ul><li>Bandit's server-level <tt>websocket_options.compress</tt> is enabled (it defaults to <tt>true</tt>).</li><li>The per-upgrade <tt>compress: true</tt> option is passed to <tt>WebSockAdapter.upgrade/4</tt> (it defaults to <tt>false</tt>; Phoenix's default is also <tt>false</tt>).</li></ul>Stock Phoenix and LiveView applications are not affected because <tt>compress: false</tt> is their default.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.11.0", "versionStartIncluding": "0.5.9"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:26.362Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39804", "state": "PUBLISHED", "dateUpdated": "2026-05-27T15:41:26.362Z", "dateReserved": "2026-04-07T12:28:54.916Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-01T20:34:24.604Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "packageName": "bandit", "packageURL": "pkg:hex/bandit", "product": "bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "1.11.0", "status": "affected", "version": "0.5.9", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Bandit.WebSocket.PerMessageDeflate'"], "packageName": "mtrudel/bandit", "packageURL": "pkg:github/mtrudel/bandit", "product": "bandit", "programFiles": ["lib/bandit/websocket/permessage_deflate.ex"], "programRoutines": [{"name": "'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2"}], "repo": "https://github.com/mtrudel/bandit", "vendor": "mtrudel", "versions": [{"lessThan": "8156921a51e684a951221da7bc30a70a022f722e", "status": "affected", "version": "da4027cff7d2b80319e76fe7a32f84beceec490a", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.\n\n'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.\n\nAn unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.\n\nThis vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.\n\nThis issue affects bandit: from 0.5.9 before 1.11.0."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n en mtrudel bandit permite la denegaci\u00f3n de servicio remota no autenticada a trav\u00e9s del agotamiento de la memoria cuando la compresi\u00f3n WebSocket permessage-deflate est\u00e1 habilitada.\n\n\u2019Elixir.Bandit.WebSocket.PerMessageDeflate\u2019:inflate/2 en lib/bandit/websocket/permessage_deflate.ex llama a :zlib.inflate/2 sin l\u00edmite de tama\u00f1o de salida, luego materializa la carga \u00fatil descomprimida completa como un \u00fanico binario a trav\u00e9s de IO.iodata_to_binary/1. La opci\u00f3n websocket_options.max_frame_size solo limita el tama\u00f1o del marco en tr\u00e1nsito (comprimido), no la salida descomprimida. Un marco comprimido de alta relaci\u00f3n (por ejemplo, datos uniformes con una relaci\u00f3n de ~1024:1) puede permanecer muy por debajo de cualquier l\u00edmite de tama\u00f1o de cable mientras fuerza asignaciones de pila a escala de GiB en el proceso de conexi\u00f3n antes de que se ejecute cualquier c\u00f3digo de aplicaci\u00f3n.\n\nUn atacante no autenticado que puede abrir una conexi\u00f3n WebSocket puede enviar un \u00fanico marco de este tipo para agotar la memoria del nodo BEAM y activar una eliminaci\u00f3n por OOM.\n\nEsta vulnerabilidad requiere que tanto la opci\u00f3n websocket_options.compress a nivel de servidor de Bandit como la opci\u00f3n compress: true por actualizaci\u00f3n pasada a WebSockAdapter.upgrade/4 est\u00e9n habilitadas. Las aplicaciones est\u00e1ndar de Phoenix y LiveView no se ven afectadas ya que por defecto tienen compress: false.\n\nEste problema afecta a bandit: desde 0.5.9 antes de 1.11.0."}], "id": "CVE-2026-39804", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39804", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-02T01:19:00.687361Z", "version": "2.0.3"}}]}, "published": "2026-05-01T21:16:16.853", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-39804.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-39804"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "bandit: Bandit: Denial of Service due to memory exhaustion via WebSocket permessage-deflate compression", "id": "2464589", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464589"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.\n'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.\nAn unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.\nThis vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.\nThis issue affects bandit: from 0.5.9 before 1.11.0.", "A flaw was found in bandit. An unauthenticated attacker who can open a WebSocket connection can exploit a vulnerability when WebSocket permessage-deflate compression is enabled. This flaw allows for memory exhaustion by sending a highly compressed frame that, when decompressed, forces large memory allocations. This can lead to a denial of service (DoS) by exhausting the system's memory and causing the application to crash."], "name": "CVE-2026-39804", "public_date": "2026-05-01T20:34:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39804\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39804\nhttps://cna.erlef.org/cves/CVE-2026-39804.html\nhttps://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e\nhttps://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j\nhttps://osv.dev/vulnerability/EEF-CVE-2026-39804"], "statement": "This IMPORTANT DoS vulnerability in Bandit affects WebSocket connections with permessage-deflate compression enabled. Exploitation requires no authentication and is network-accessible. Impact is high availability loss through memory exhaustion. Stock Phoenix and LiveView applications are not affected as they default to compress: false. Affects Bandit versions 0.5.9 to before 1.11.0.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.9,1.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da4027cff7d2b80319e76fe7a32f84beceec490a,1.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "bandit", "source": "cna", "vendor": "mtrudel"}, "product": "bandit", "vendor": "mtrudel"}], "created": "2026-05-02T07:00:06.934174+00:00", "updated": "2026-05-04T16:07:19.108563+00:00", "vendors": ["mtrudel", "mtrudel$PRODUCT$bandit"]}