Phoenix transports allow an unlimited number of channel joins per transport process. Each phx_join message started by a client creates a long‑lived channel process. This is a resource exhaustion vulnerability classified as CWE‑770. An unauthenticated attacker can send a massive number of joins over a single WebSocket or LongPoll connection, spawning hundreds of thousands of channel processes. When the BEAM process table reaches its maximum the virtual machine can no longer spawn new processes, causing the entire node to become unresponsive and denying service to all legitimate traffic.

The vulnerability affects the Phoenix Framework Phoenix from 0.11.0 up to but not including 1.5.15, from 1.6.0‑rc.0 up to but not including 1.6.17, from 1.7.0‑rc.0 up to but not including 1.7.24, and from 1.8.0‑rc.0 up to but not including 1.8.9.

The CVSS score of 8.7 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV catalog. The likely attack vector is an unauthenticated user flooding a single socket connection with phx_join messages via WebSocket or LongPoll transport. Because the amplification occurs inside the connection, network‑layer connection caps and rate limiting do not mitigate the attack. An attacker can exhaust the BEAM process table, rendering the entire Erlang/Elixir node unusable.