UBUNTU-CVE-2026-114213: High severity ubuntu/bandit vulnerability
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks maxfragmentedmessagesize against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout. This issue affects bandit: from 1.11.0 before 1.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
banditto a version that resolves this vulnerability.Fixed in 1.14.0
Event History
Frequently Asked Questions
Which Bandit versions are affected?
The issue affects Bandit versions from 1.11.0 up to, but not including, 1.14.0.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue through a WebSocket connection.
Are deployments using the default message-size setting exposed?
Yes. With the default 8 MB fragmented-message limit, a single connection can consume roughly 1.2 to 1.4 GB of server memory using many 1-byte continuation frames.
Will an idle WebSocket timeout stop this attack?
Not reliably. The attacker can send ping frames between fragments to keep the connection alive beyond the idle timeout.