This vulnerability (CVE-2026-56811) in phoenixframework phoenix's Phoenix.Socket module (specifically in lib/phoenix/socket.ex and the handle_in/4 routine) allows an unauthenticated attacker to cause a denial of service by exploiting the lack of limits on the number of channels a single transport process may join. An attacker can open one WebSocket or LongPoll connection and send many phx_join messages, spawning hundreds of thousands of channel processes and exhausting the BEAM process table. This prevents the virtual machine from starting new processes, denying service to all legitimate traffic on the node. The amplification occurs within a single connection, so network-layer connection caps and rate limiting do not mitigate the attack. The framework introduced a :max_channels_per_transport option (default 100) to limit channels per transport process, forcing abusive clients to open multiple connections where external throttling can be applied. The vulnerability affects phoenix versions from 0.11.0 before 1.5.15, 1.6.0 before 1.6.17, 1.7.0 before 1.7.24, and 1.8.0 before 1.8.9. No explicit patch or official fix status is provided in the data.

An unauthenticated attacker can cause a denial of service by exhausting the BEAM process table on a node running an affected Phoenix version. This prevents new processes from starting, effectively denying service to all legitimate users on that node. The attack bypasses typical network-layer rate limiting because the amplification happens within a single WebSocket or LongPoll connection. This can severely disrupt availability of applications using the Phoenix framework with vulnerable versions.

The Phoenix framework introduced a :max_channels_per_transport option (defaulting to 100) to limit the number of channels a single transport process can join, mitigating the risk by forcing abusive clients to open multiple connections that can be throttled externally. However, the provided data does not confirm an official patch or remediation level. Users should upgrade to versions 1.5.15, 1.6.17, 1.7.24, or 1.8.9 or later where this option is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.