The vulnerability is an allocation of resources without limits or throttling in the WebSocket fragment reassembly of Bandit. An unauthenticated remote attacker can send a fragmented message composed of many 1‑byte continuation frames. Each 1‑byte fragment consumes roughly 150‑170 bytes of server memory, allowing an attacker to exhaust up to about 1.2–1.4 GB per connection on the default 8 MB limit, potentially causing a denial of service.

Bandit (mtrudel:bandit) versions 1.11.0 through 1.13.9 are affected. The issue does not exist in 1.14.0 or newer.

The CVSS score is 8.7, indicating a high severity. EPSS is not available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is an unauthenticated remote connection to a WebSocket endpoint, where the attacker sends many 1‑byte continuation frames that bypass the max_fragmented_message_size check. The default logic stores each non‑final continuation frame in a separate list cell, so an attacker can consume server memory with a single persistent connection and may crash or degrade the service.