GHSA-628H-Q48J-JR6Q

Vulnerability from github – Published: 2026-05-08 20:24 – Updated: 2026-05-08 20:24
VLAI
Summary
Phoenix: Long-poll NDJSON body splitting causes large memory allocation
Details

Summary

An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of concurrent requests can be sufficient to let the node run out of memory.

See also https://cna.erlef.org/cves/CVE-2026-32689.html.

Details

The unoptimised code path exists on the application/x-ndjson POST handling in the LongPoll transport. The endpoint requires only a session token, which any client can obtain by issuing a GET to the same URL with a matching Origin header, so exploitation is unauthenticated.

Impact

Anyone who runs a LiveView app with a public Longpoll socket or uses a Phoenix.Socket with longpoll option. Longpoll has been enabled for newly generated Phoenix projects since Phoenix 1.7.11.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "phoenix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Hex",
        "name": "phoenix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0"
            },
            {
              "fixed": "1.8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T20:24:15Z",
    "nvd_published_at": "2026-05-05T16:16:11Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn unauthenticated denial-of-service vulnerability in Phoenix\u0027s long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of concurrent requests can be sufficient to let the node run out of memory.\n\nSee also https://cna.erlef.org/cves/CVE-2026-32689.html.\n\n### Details\n\nThe unoptimised code path exists on the `application/x-ndjson` POST handling in the LongPoll transport. The endpoint requires only a session token, which any client can obtain by issuing a GET to the same URL with a matching `Origin` header, so exploitation is unauthenticated.\n\n### Impact\n\nAnyone who runs a LiveView app with a public Longpoll socket or uses a `Phoenix.Socket` with longpoll option.\nLongpoll has been enabled for newly generated Phoenix projects since Phoenix 1.7.11.",
  "id": "GHSA-628h-q48j-jr6q",
  "modified": "2026-05-08T20:24:15Z",
  "published": "2026-05-08T20:24:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phoenixframework/phoenix/security/advisories/GHSA-628h-q48j-jr6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32689"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phoenixframework/phoenix/commit/1a67c61ff9ce0a7711662ac7354861917a7c80f7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phoenixframework/phoenix/commit/912ea181fd247c21dbcc49fb97d0053b947d81bf"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-32689.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phoenixframework/phoenix"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32689"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Phoenix: Long-poll NDJSON body splitting causes large memory allocation"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.