CVE-2026-39804 is a denial-of-service vulnerability in Bandit's WebSocket permessage-deflate implementation. When enabled, an unauthenticated attacker can send a single compressed WebSocket frame that decompresses to a very large size, causing the BEAM virtual machine to exhaust memory and potentially crash. This occurs because the decompression step lacks an output size limit, allowing a small compressed payload to inflate to multiple gigabytes in memory. The vulnerability affects Bandit versions from 0.5.8 up to but not including 1.11.0. Default Phoenix and LiveView apps are not affected as they disable compression by default. The issue requires explicit opt-in to compression on the WebSocket upgrade. A fix is available in Bandit 1.11.0.