# CVE-2026-56811: Phoenix Framework denial of service via unbounded channel joins in Phoenix.Socket

Source: https://junglewise.ai/threats/cve-2026-56811-phoenix-framework-denial-of-service-via-unbounded-channel-joins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56811 · Severity: high · CVSS 7.5 · Published 2026-07-07

Phoenix is a popular web framework for Elixir that handles real-time communication through WebSocket and LongPoll transports. An attacker can exploit a missing resource limit to spawn hundreds of thousands of channels across a single connection, exhausting the VM process limit and causing the application to become unavailable. This denial of service attack requires no authentication and can be executed from any network-connected client.

## Quick answers

**Is CVE-2026-56811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56811 being exploited in the wild.

**How severe is CVE-2026-56811?** High severity, with a CVSS score of 7.5, published 7 July 2026.

**Which products and versions are affected?** Phoenix Framework 0.11.0 to 1.5.14, 1.6.0-rc.0 to 1.6.16, 1.7.0-rc.0 to 1.7.23, 1.8.0-rc.0 to 1.8.8.

**Is there a fix for CVE-2026-56811?** A patch was published on 2026-09-03: Patches released for versions 1.5.15, 1.6.17, 1.7.24, and 1.8.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56811 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56811?** Check whether you run Phoenix Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Phoenix's WebSocket and LongPoll transports suffer from an unbound resource allocation vulnerability (CWE-770). The transport layer accepts unlimited channel join requests from a single connection without enforcing any per-connection channel quota. An attacker can open a single HTTP or WebSocket connection and repeatedly send channel join messages, causing the application to spawn hundreds of thousands of lightweight Erlang processes until hitting the ERTS process limit, which crashes or hangs the VM. The attack requires no authentication and exploits the fact that per-transport rate limiting was missing. The vendor mitigated this by introducing a configurable channel limit per transport, forcing attackers to establish multiple connections and allowing upstream proxies and load balancers to apply connection-level rate limits. Patches are available for all affected versions: 1.5.15, 1.6.17, 1.7.24, and 1.8.9.

## Affected products

- Phoenix Phoenix >= 0.11.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9

## Identifiers

- CVE-2026-56811
- GHSA-6983-jfq8-485w

## Timeline

- 2026-07-07: disclosed
- 2026-09-03: advisory
- 2026-09-03: patched: Patches released for versions 1.5.15, 1.6.17, 1.7.24, and 1.8.9

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [Phoenix Framework DoS in Presence JavaScript client](https://junglewise.ai/threats/cve-2026-56812-phoenix-framework-dos-in-presence-javascript-client)