The vulnerability in mtrudel bandit (CVE-2026-65623) is due to inefficient algorithmic complexity in WebSocket fragment reassembly. Specifically, the function 'Elixir.Bandit.WebSocket.Connection':oversize_message?/2 is called on every continuation frame and appends each frame to a left-nested iolist, then re-measures the entire accumulated buffer with IO.iodata_length/1. Because the buffer grows by one element per frame and is fully re-traversed each time, the reassembly work is quadratic (O(n^2)) in the number of continuation frames. Although the total message size is limited (default 8 MB), there is no limit on the number of frames, and each frame can be as small as one byte. An attacker can exploit this by sending millions of tiny continuation frames, causing CPU exhaustion and denial of service. The WebSocket read timeout does not mitigate this because it only triggers on idle connections and cannot interrupt the synchronous reassembly process. This affects bandit versions from 1.11.0 before 1.12.1.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service by exhausting CPU resources on the server hosting the bandit WebSocket service. This can lead to prolonged CPU starvation, potentially affecting many concurrent connections and denying service to legitimate users. The vulnerability does not require authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch information provided at this time. Until a patch is available, consider limiting the number of continuation frames or implementing rate limiting on WebSocket frames if possible to mitigate CPU exhaustion. Monitor vendor channels for updates and apply official fixes once released.