The vulnerability CVE-2026-42786 in mtrudel bandit (0.5.0 to before 1.11.0) is due to allocation of resources without limits or throttling (CWE-770). Specifically, the fragment reassembly path in 'Elixir.Bandit.WebSocket.Connection':handle_frame/3 appends payloads from continuation frames with fin=false to a per-connection iolist without enforcing a cumulative size cap. While max_frame_size limits individual frames, it does not limit the total size of all continuation frames combined. An attacker can send an unbounded stream of continuation frames without fin=1, causing linear growth of the BEAM heap memory until the OS or supervisor kills the process. This vulnerability affects applications using Bandit for WebSocket handling, including Phoenix Channels and LiveView, exposing them to remote denial of service.

An unauthenticated remote attacker can cause a denial of service by sending a continuous stream of WebSocket continuation frames without the fin flag set, leading to unbounded memory consumption in the Bandit WebSocket connection handler. This memory exhaustion can crash the affected process or degrade system performance. The vulnerability affects all applications using Bandit versions from 0.5.0 before 1.11.0, including Phoenix Channels and LiveView, which rely on Bandit for WebSocket handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch link provided at this time. Until a patch is available, consider implementing external WebSocket frame size monitoring or limiting connection durations at the application or infrastructure level to mitigate potential denial of service. Monitor vendor channels for updates and apply official fixes once released.