Allocation of Resources Without Limits or Throttling Affecting bandit package, versions >=0.5.9 <1.11.0

bandit is a HTTP server for Plug and WebSock apps.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Bandit.WebSocket.PerMessageDeflate.inflate process in the WebSocket compression path. An attacker can exhaust server resources by sending a highly compressed WebSocket frame that expands far beyond its compressed size. The vulnerable inflate path in Bandit.WebSocket.Connection and Bandit.WebSocket.PerMessageDeflate accepts compressed message data and decompresses it without bounding the expansion ratio, allowing a small payload to trigger excessive memory and CPU consumption during WebSocket message handling. This can stall or crash the server process and disrupt WebSocket connections for legitimate users.

Notes

• The vulnerable path is only reachable when permessage-deflate is explicitly negotiated on the upgrade; stock Phoenix and LiveView deployments keep compress: false, so they do not enter this code path by default.
• max_frame_size only constrains the compressed WebSocket frame on the wire. A payload can stay under that limit and still expand far beyond it during inflation, so wire-size caps do not bound the memory/CPU cost of processing the message.

Workarounds

• Disable WebSocket permessage-deflate by keeping compress: false on your WebSocket upgrade configuration, for example, in Phoenix endpoint/socket settings or WebSockAdapter.upgrade. This prevents unauthenticated clients from sending a small compressed frame that expands into excessive memory use.

• GitHub Commit
• Maintainer's Advisory