Bandit’s WebSocket implementation permits an attacker to send an unbounded series of continuation frames without setting the final bit, causing the library to append each payload to a per‑connection iolist without a cumulative size limit. This can grow the BEAM heap linearly until it exhausts available memory, resulting in the process being killed by the OS or a supervisor. The vulnerability is triggered by unauthenticated remote clients and can be used to cause a denial of service on the affected node.

mtrudel:bandit versions from 0.5.0 up to but not including 1.11.0 are affected. Applications that embed Bandit, such as Phoenix Channels and LiveView, inherit the same vulnerability when they accept WebSocket connections.

The CVSS score of 8.7 indicates high severity for resource exhaustion. EPSS is not available, but the lack of a limit on memory usage suggests the attack surface is exploitable with minimal effort, likely over the network. The issue is not listed in KEV, yet the ability to crash a node quickly makes it attractive to attackers seeking to disrupt service. The attack vector is remote unauthenticated connections sending continuous WebSocket continuation frames, particularly over Bandit‑powered Phoenix or LiveView applications.