CVE-2026-42786 is a high-severity vulnerability in Bandit versions >=0.5.0 and <1.11.0 that allows an unauthenticated WebSocket client to exhaust server memory by sending an unbounded stream of fragmented WebSocket continuation frames without a final frame. This causes the server to accumulate data in memory without limit, leading to denial of service via out-of-memory conditions. The vulnerability affects any Bandit-fronted application accepting WebSocket connections, including Phoenix applications using LiveView or Channels. A fix is available in Bandit 1.11.0 that adds a configurable maximum message size and terminates connections exceeding it.