UBUNTU-CVE-2026-110314: Medium severity ubuntu/bandit vulnerability

Published Oct 26, 2026

Updated

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handleframe/3 and handleinfo/3 never check that state, so later frames still reach handlein/2 and later messages reach handleinfo/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.

Affected Software

7 affected components

ubuntu/bandit*

Event History

Oct 26, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using bandit versions from 0.5.1 up to, but not including, 1.14.0 are affected. The issue is relevant where WebSocket callbacks can perform security-sensitive actions after a connection is rejected or stopped.

What must an attacker do to exploit this?

A remote client must continue sending WebSocket data frames after the server sends a Close frame and before the client closes, the TCP connection drops, or the idle timeout expires. No authentication or user interaction is required according to the provided vector.

What is the practical impact of a failed connection authorization check?

If a callback stops a connection after a failed token check, the client can still cause later frames to reach WebSocket handler code. This could allow execution of actions intended only for authorized or administrative clients if those actions remain reachable through the handler.

How can I determine whether an instance is vulnerable?

Check the deployed bandit version. Versions earlier than 0.5.1 are not identified as affected by the provided data, while versions 0.5.1 through 1.13.x are affected; version 1.14.0 is outside the affected range.

UBUNTU-CVE-2026-110314: Medium severity ubuntu/bandit vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this?

What is the practical impact of a failed connection authorization check?

How can I determine whether an instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this?

What is the practical impact of a failed connection authorization check?

How can I determine whether an instance is vulnerable?