Allocation of Resources Without Limits or Throttling Affecting bandit package, versions >=0.5.1 <1.11.0

bandit is a HTTP server for Plug and WebSock apps.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Bandit.WebSocket.Connection fragmented-frame handling in the WebSocket components. An attacker can force the server to buffer unbounded fragmented messages or trigger protocol errors by sending a long sequence of continuation frames, including zero-length non-final continuations. The vulnerable path accepts fragmented WebSocket payloads without enforcing a message-size limit across continuation frames, so a client can stream arbitrarily large messages and consume memory until the connection or process is disrupted. It also accepts empty non-final continuation frames, allowing a peer to drive the connection into malformed fragmentation states that terminate the WebSocket session and disrupt service for connected users.

Workarounds

• Set max_fragmented_message_size on Bandit’s WebSocket options to a finite value to cap the total size of a fragmented message and prevent a single client from buffering unbounded continuation frames into memory.
• Keep max_frame_size enabled with a nonzero limit to bound the size of each individual WebSocket frame and reduce the amount of data any one frame can contribute to a fragmented-message flood.

• GitHub Commit
• Maintainer's Advisory