CVE-2026-42786: Bandit WebSocket 缓冲区溢出致 OOM 漏洞

Bandit 缓冲区溢出漏洞总结 漏洞概述 漏洞名称：Bandit 缓冲区溢出未终止的 WebSocket 续传帧，导致 OOM 杀死主机 CVE ID：CVE-2026-42786 严重程度：高 (8.7/10) 影响版本：>= 0.5.0 和 < 1.11.0 修复版本：1.11.0 影响范围 任何接受 WebSocket 连接的 Bandit 前端应用 单个未认证的 WebSocket 客户端可以耗尽服务器内存 攻击者无需发送 ，只需保持连接打开即可 影响 Phoenix Channels 和 LiveView 等 Phoenix 应用 不受负载均衡器、反向代理或 TLS 终止进程的保护 修复方案 升级到 Bandit 1.11.0 在连接状态上配置 当超过限制时，使用 RFC 6455 代码 1009 ( ) 终止连接 POC 代码 ```elixir Bandit WebSocket fragmented-message accumulation PoC. lib/bandit/websocket/connection.ex:80-95 appends every incoming continuation frame to connection.fragment_frame.data as is, with no cumulative cap. max_frame_size only bounds "each" frame. A peer that streams an unbounded number of max-sized continuations without ever setting fin=1 grows the iolist linearly in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_0

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2026-42786: Bandit WebSocket 缓冲区溢出致 OOM 漏洞

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2026-42786: Bandit WebSocket 缓冲区溢出致 OOM 漏洞

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！