CVE-2026-110314
Awaiting Analysis Awaiting Analysis - Queue

Client-Side Enforcement of Server-Side Security in Bandit WebSocket Handling

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action. This issue affects bandit: from 0.5.1 before 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-110314
EUVD
EUVD-2026-109822

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mtrudel bandit 0.5.1
mtrudel bandit bb407f2277dcb65a58dd8cc07913a0b58a80e266

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110314 is a WebSocket handling flaw in the Bandit library (versions 0.5.1 to 1.14.0). When a server tries to close a WebSocket connection, the client can ignore the server's Close frame and keep sending data. The server's connection process remains active in a :closing state but does not validate this state in subsequent frame handling. This allows the client to trigger handler functions with stale authorization states, potentially bypassing security checks like admin-only actions.

Detection Guidance

Detecting this vulnerability requires monitoring WebSocket connections for improper state handling after a server attempts to close the connection. Check if WebSocket handlers continue processing frames after the server sends a Close frame. Monitor for unauthorized actions triggered by stale state in handle_in/2 or handle_info/2 callbacks.

Impact Analysis

An attacker could exploit this to bypass security controls, such as performing unauthorized admin actions after being disconnected. The vulnerability allows continued processing of client frames even after the server initiates termination, enabling unauthorized access or actions until the connection fully closes.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating compliance requirements for access control and session management in standards like GDPR and HIPAA. Unauthorized admin actions or data access may result in non-compliance with security and privacy controls.

Mitigation Strategies

Upgrade Bandit to version 1.14.0 or later to apply the patch. If upgrading is not immediately possible, implement a workaround by explicitly marking the WebSocket state as stopped and ignoring further actions until the connection fully terminates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart