CVE-2026-110314 WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-110314?
CVE-2026-110314 is a medium-severity vulnerability in mtrudel bandit, published on 26 Oct 2026.
Official description
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.
When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.
This issue affects bandit: from 0.5.1 before 1.14.0.
Weakness: CWE-602
Which versions are affected by CVE-2026-110314?
1 open source package ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 0.5.1 | 1.14.0 |
How do I fix CVE-2026-110314?
Upgrade bandit to 1.14.0 or later.
Is CVE-2026-110314 being exploited?
There is no known exploitation of CVE-2026-110314 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-110314, GHSA-2v5v-8f9v-xh85, UBUNTU-CVE-2026-110314.