{"id":"CVE-2026-56811","aliases":["GHSA-6983-jfq8-485w"],"title":"Phoenix: Unbounded channel joins per transport enables DoS over few connections","summary":"Phoenix: Unbounded channel joins per transport enables DoS over few connections","severity":"high","cvss":7.5,"cwe":["CWE-770"],"vendor":"phoenix","product":"phoenix","ecosystem":"erlang","affected":["phoenix >= 0.11.0, < 1.5.15","phoenix >= 1.6.0-rc.0, < 1.6.17","phoenix >= 1.7.0-rc.0, < 1.7.24","phoenix >= 1.8.0-rc.0, < 1.8.9"],"patched":["phoenix 1.5.15","phoenix 1.6.17","phoenix 1.7.24","phoenix 1.8.9"],"published":"2026-09-03","updated":"2026-09-03","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6983-jfq8-485w","references":[{"url":"https://github.com/phoenixframework/phoenix/security/advisories/GHSA-6983-jfq8-485w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56811"},{"url":"https://github.com/phoenixframework/phoenix/commit/16e295d2fccab185d1292322e2bee5d46c725c8a"},{"url":"https://github.com/phoenixframework/phoenix/commit/a612100cd8a4279091abc1a2ef8fb98a6d01c0a1"},{"url":"https://github.com/phoenixframework/phoenix/commit/c498ba8cf49f6accbbd0c643a5340b58db891218"},{"url":"https://github.com/phoenixframework/phoenix/commit/d19ca0a8d9f82c130b7ed339b9f033433e2dea5e"},{"url":"https://cna.erlef.org/cves/CVE-2026-56811.html"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-56811"},{"url":"https://github.com/advisories/GHSA-6983-jfq8-485w"}],"tags":["ghsa","erlang"],"epss":0.00757,"epssPercentile":0.53248,"ingestedAt":"2026-09-03T21:08:46.069Z","slug":"CVE-2026-56811","body":"## Overview\n\n### Summary\n\nPhoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily.\n\n### Impact\n\nAn unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.\n\n## Affected packages\n\n- `phoenix >= 0.11.0, < 1.5.15`\n- `phoenix >= 1.6.0-rc.0, < 1.6.17`\n- `phoenix >= 1.7.0-rc.0, < 1.7.24`\n- `phoenix >= 1.8.0-rc.0, < 1.8.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `phoenix 1.5.15`\n- `phoenix 1.6.17`\n- `phoenix 1.7.24`\n- `phoenix 1.8.9`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}