CVE-2026-39804: Remote Code Execution and DoS via Bandit WebSocket Permessage-Deflate Resource Exhaustion

Vulnerability ID: CVE-2026-39804

CVSS Score: 8.2

Published: 2026-05-07

CVE-2026-39804 is a critical resource exhaustion vulnerability (CWE-770) affecting the Bandit Elixir HTTP server. By exploiting unbounded DEFLATE decompression in WebSocket frames, an unauthenticated attacker can crash the Erlang VM (BEAM) via a highly compressed decompression bomb.

TL;DR

Unauthenticated remote attackers can trigger a Denial of Service (OOM crash) in the Bandit web server by sending a highly compressed WebSocket frame, exhausting BEAM memory if permessage-deflate is enabled.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-770

Attack Vector : Network (Remote)

CVSS v4.0 Score : 8.2 (High)

EPSS Score : 0.0004 (11.83%)

Exploit Status : Proof-of-Concept Available

Impact : Denial of Service (Node Crash)

Affected Systems

Bandit HTTP Server (mtrudel/bandit)

bandit : >= 0.5.9, < 1.11.0 (Fixed in: 1.11.0…