Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110314— WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Quick assessment

Affected
mtrudel bandit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 mtrudel 项目的 Bandit 库中，WebSocket 连接处理存在“客户端强制执行服务端安全”的漏洞。远程客户端可以在服务端已终止连接后，通过忽略服务端的 Close 帧并继续发送数据帧，使 WebSocket 处理器代码继续运行。 当 WebSocket 回调返回 时， 会调用 ，发送 Close 帧并关闭写端，但连接进程仍保持在 状态继续运行。由于 和 从未检查该状态，后续的数据帧仍会传递至 ，后续的消息仍会传递至 ，且使用的是 元组中的状态，直到客户端发送 Close 帧、TCP 连接断开或空闲

CVSS 6.3 · Medium EPSS 0.38% · P32

Affected Version Matrix 2

VendorProduct Version RangeStatus
mtrudel bandit 0.5.1< 1.14.0 affected
bb407f2277dcb65a58dd8cc07913a0b58a80e266< 220b9dfd27f9a21305be2afc75cbe585ddc24e7a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110314

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
Source: CVE Program / CVE List V5
Vulnerability Description
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端安全的客户端实施
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mtrudel bandit 0.5.1 ~ 1.14.0 cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*
mtrudel bandit bb407f2277dcb65a58dd8cc07913a0b58a80e266 ~ 220b9dfd27f9a21305be2afc75cbe585ddc24e7a cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-110314

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110314

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110314 (1)

Vendor Advisories for CVE-2026-110314 (2)

Other References for CVE-2026-110314 (1)

Same Patch Batch · mtrudel · 2026-10-26 · 11 CVEs total

CVE-2026-114213 8.7 HIGH WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
CVE-2026-109584 8.7 HIGH HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation i
CVE-2026-111101 8.7 HIGH HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
CVE-2026-113436 8.7 HIGH Quadratic bignum parsing of Content-Length and Host port values in Bandit
CVE-2026-108529 8.7 HIGH SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in
CVE-2026-108525 8.7 HIGH HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stre
CVE-2026-115269 8.7 HIGH HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
CVE-2026-110499 8.7 HIGH Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state w
CVE-2026-111103 8.2 HIGH HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits
CVE-2026-114216 6.3 MEDIUM Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

IV. Related Vulnerabilities

Same product: bandit
Same vendor: mtrudel
Same weakness: CWE-602