CVE-2026-65623: bandit 1.11.0 to before 1.12.1

Affected technology

bandit · 1.11.0 to before 1.12.1
mtrudel

bandit · 21612c7c7b1ce43eccd36d3af3a2299d23513667 to before 418ef7e906192a230ddba112f7a669c87b6b0e3a
mtrudel

Component: Elixir.Bandit.WebSocket.Connection
Function: 'Elixir.Bandit.WebSocket.Connection':handle_frame/3, 'Elixir.Bandit.WebSocket.Connection':oversize_message?/2
File: lib/bandit/websocket/connection.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.