Bandit implements WebSocket fragment reassembly by appending each non‑final continuation frame to a nested iolist and then measuring the total buffer length with IO.iodata_length/1 on every frame. Because the buffer grows linearly with the number of frames and the entire buffer is traversed each time, the reassembly work grows quadratically (O(n²)) in the number of continuation frames. An unauthenticated attacker can send a huge number of tiny continuation frames, forcing the server to perform many nested traversals that exhaust CPU cycles. The result is a remote denial of service; legitimate clients experience long delays or disconnections while the server is pinned on the reassembly task for minutes to hours.

The flaw affects Bandit version 1.11.0 through 1.12.0, all released under the mtrudel:bandit product. Version 1.12.1 and later contain the fix that removes the redundant traversal during fragment reassembly.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1 % reflects a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an attacker opens a WebSocket connection to Bandit and transmits a very large number of continuation frames with small payloads. Because the reassembly logic is performed synchronously without an inter‑frame timeout, there is no automated interruption once the process starts. In an environment where Bandit serves many concurrent connections, a single malicious session can cause overall CPU starvation, leading to widespread server unavailability.