CVE-2026-39804 WebSocket permessage-deflate inflate has no output-size cap in bandit
Unauthenticated attackers can cause memory exhaustion and denial of service via WebSocket compression if specific options are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39804?
CVE-2026-39804 is a high-severity denial of service vulnerability in mtrudel bandit, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permessage-deflate compression is enabled.
'Elixir.Bandit.WebSocket.PerMessageDeflate':inflate/2 in lib/bandit/websocket/permessage_deflate.ex calls :zlib.inflate/2 with no output-size cap, then materializes the entire decompressed payload as a single binary via IO.iodata_to_binary/1. The websocket_options.max_frame_size option only bounds the on-the-wire (compressed) frame size, not the decompressed output. A high-ratio compressed frame (e.g. uniform data at ~1024:1 ratio) can stay well under any wire-size limit while forcing GiB-scale heap allocations in the connection process before any application code runs.
An unauthenticated attacker who can open a WebSocket connection can send a single such frame to exhaust the BEAM node's memory and trigger an OOM kill.
This vulnerability requires both Bandit's server-level websocket_options.compress and the per-upgrade compress: true option passed to WebSockAdapter.upgrade/4 to be enabled. Stock Phoenix and LiveView applications are not affected as they default to compress: false.
This issue affects bandit: from 0.5.9 before 1.11.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-39804?
3 open source packages ship an affected version, including bandit.
| Package | Affected | Fixed in |
|---|---|---|
bandit Hex | From 0.5.8 | 1.11.0 |
bandit Hex | From 0.5.8 | 1.11.0 |
bandit Hex | From 0.5.9 | 1.11.0 |
How do I fix CVE-2026-39804?
Upgrade bandit to 1.11.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-39804 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39804 exists.
Sources
Also known as EEF-CVE-2026-39804, GHSA-frh3-6pv6-rc8j.