CVE-2026-56811
Phoenix: Unbounded channel joins per transport enables DoS over few connections
Summary
### Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily. ### Impact An unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| erlang | phoenix | — | 1.5.15, 1.6.17, 1.7.24, 1.8.9 |
Remediation: Upgrade to 1.5.15 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.