Executive brief
Phoenix is a popular web framework for Elixir that handles real-time communication through WebSocket and LongPoll transports. An attacker can exploit a missing resource limit to spawn hundreds of thousands of channels across a single connection, exhausting the VM process limit and causing the application to become unavailable. This denial of service attack requires no authentication and can be executed from any network-connected client.
Technical details
Phoenix's WebSocket and LongPoll transports suffer from an unbound resource allocation vulnerability (CWE-770). The transport layer accepts unlimited channel join requests from a single connection without enforcing any per-connection channel quota. An attacker can open a single HTTP or WebSocket connection and repeatedly send channel join messages, causing the application to spawn hundreds of thousands of lightweight Erlang processes until hitting the ERTS process limit, which crashes or hangs the VM. The attack requires no authentication and exploits the fact that per-transport rate limiting was missing. The vendor mitigated this by introducing a configurable channel limit per transport, forcing attackers to establish multiple connections and allowing upstream proxies and load balancers to apply connection-level rate limits. Patches are available for all affected versions: 1.5.15, 1.6.17, 1.7.24, and 1.8.9.
Affected products
- Phoenix Phoenix >= 0.11.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9
Timeline
- 2026-07-07: disclosed
- 2026-09-03: advisory
- 2026-09-03: patched: Patches released for versions 1.5.15, 1.6.17, 1.7.24, and 1.8.9