Vulnerability · Published Oct 26, 2026 · Assigned by EEF
CVE-2026-110314WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
Medium 6.3
In plain English
A medium-severity security flaw in bandit from mtrudel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-110314 |
| Ubuntu:24.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-110314 |
| Ubuntu:26.04:LTS | bandit | no fix listed | UBUNTU-CVE-2026-110314 |
| Ubuntu:26.10 | bandit | no fix listed | UBUNTU-CVE-2026-110314 |
Affected products (as reported)
Weakness: CWE-602 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N