CVE-2026-42786: Unbounded WebSocket Fragmented Message Reassembly Denial of Service in Bandit

Vulnerability ID: CVE-2026-42786

CVSS Score: 8.7

Published: 2026-05-07

An unauthenticated remote denial of service vulnerability exists in the Bandit HTTP server due to unbounded resource allocation during WebSocket fragment reassembly. Attackers can trigger complete memory exhaustion by streaming continuous WebSocket frames without the finalization bit, causing the Erlang virtual machine to crash.

TL;DR

Bandit < 1.11.0 fails to limit cumulative size of fragmented WebSocket messages, allowing unauthenticated attackers to cause an Out-of-Memory (OOM) denial of service by sending infinite continuation frames.

Technical Details

CWE ID : CWE-770

Attack Vector : Network (Unauthenticated)

CVSS 4.0 Score : 8.7 (High)

EPSS Percentile : 17.28%

Primary Impact : Denial of Service (OOM)

Exploit Status : None (Theoretical PoC)

CISA KEV : No

Affected Systems

Bandit HTTP Server (0.5.0 up to 1.11.0)

Phoenix Web…