~ / search / GHSA-6983-jfq8-485w

GHSA-6983-jfq8-485w

Phoenix: Unbounded channel joins per transport enables DoS over few connections

Source: GitHub Advisory Database (reviewed) High CVE-2026-56811

Packages

EcosystemPackageAffectedFixed in
Hex phoenix >= 0.11.0, < 1.5.15 1.5.15
Hex phoenix >= 1.6.0-rc.0, < 1.6.17 1.6.17
Hex phoenix >= 1.7.0-rc.0, < 1.7.24 1.7.24
Hex phoenix >= 1.8.0-rc.0, < 1.8.9 1.8.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily. ### Impact An unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.

References

External links from the advisory. They lead to third-party sites.