CVE-2026-42786: Bandit WebSocket Unbounded Fragment Accumulation OOM Vulnerability

Bandit 缓冲区溢出漏洞总结 漏洞概述 漏洞名称：Bandit 缓冲区溢出未终止的 WebSocket 续传帧，导致 OOM 杀死主机 CVE ID：CVE-2026-42786 严重程度：高 (8.7/10) 影响版本：>= 0.5.0 和 < 1.11.0 修复版本：1.11.0 影响范围 任何接受 WebSocket 连接的 Bandit 前端应用 单个未认证的 WebSocket 客户端可以耗尽服务器内存 攻击者无需发送 ，只需保持连接打开即可 影响 Phoenix Channels 和 LiveView 等 Phoenix 应用 不受负载均衡器、反向代理或 TLS 终止进程的保护 修复方案 升级到 Bandit 1.11.0 在连接状态上配置 当超过限制时，使用 RFC 6455 代码 1009 ( ) 终止连接 POC 代码 ```elixir Bandit WebSocket fragmented-message accumulation PoC. lib/bandit/websocket/connection.ex:80-95 appends every incoming continuation frame to connection.fragment_frame.data as is, with no cumulative cap. max_frame_size only bounds "each" frame. A peer that streams an unbounded number of max-sized continuations without ever setting fin=1 grows the iolist linearly in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_024_to_binary/1 in BEAM memory until the OS kills the process. The eventual 10_0

目標達成すべての支援者に感謝 — 100%達成しました！

CVE-2026-42786: Bandit WebSocket Unbounded Fragment Accumulation OOM Vulnerability

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

CVE-2026-42786: Bandit WebSocket Unbounded Fragment Accumulation OOM Vulnerability

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！