{"id":"GHSA-6983-jfq8-485w","summary":"Phoenix: Unbounded channel joins per transport enables DoS over few connections","details":"### Summary\n\nPhoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily.\n\n### Impact\n\nAn unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.","aliases":["CVE-2026-56811","EEF-CVE-2026-56811"],"modified":"2026-09-03T20:45:04.969699139Z","published":"2026-09-03T20:33:03Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-09-03T20:33:03Z","nvd_published_at":"2026-07-07T16:16:40Z","cwe_ids":["CWE-770"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/phoenixframework/phoenix/security/advisories/GHSA-6983-jfq8-485w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56811"},{"type":"WEB","url":"https://github.com/phoenixframework/phoenix/commit/16e295d2fccab185d1292322e2bee5d46c725c8a"},{"type":"WEB","url":"https://github.com/phoenixframework/phoenix/commit/a612100cd8a4279091abc1a2ef8fb98a6d01c0a1"},{"type":"WEB","url":"https://github.com/phoenixframework/phoenix/commit/c498ba8cf49f6accbbd0c643a5340b58db891218"},{"type":"WEB","url":"https://github.com/phoenixframework/phoenix/commit/d19ca0a8d9f82c130b7ed339b9f033433e2dea5e"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-56811.html"},{"type":"PACKAGE","url":"https://github.com/phoenixframework/phoenix"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-56811"}],"affected":[{"package":{"name":"phoenix","ecosystem":"Hex","purl":"pkg:hex/phoenix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"1.5.15"}]}],"versions":["0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.15.0","0.16.0","0.16.1","0.17.0","0.17.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.0-rc.0","1.2.0-rc.1","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.0-rc.0","1.3.0-rc.1","1.3.0-rc.2","1.3.0-rc.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.0-rc.0","1.4.0-rc.1","1.4.0-rc.2","1.4.0-rc.3","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-rc.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6983-jfq8-485w/GHSA-6983-jfq8-485w.json"}},{"package":{"name":"phoenix","ecosystem":"Hex","purl":"pkg:hex/phoenix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0-rc.0"},{"fixed":"1.6.17"}]}],"versions":["1.6.0","1.6.0-rc.0","1.6.0-rc.1","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6983-jfq8-485w/GHSA-6983-jfq8-485w.json"}},{"package":{"name":"phoenix","ecosystem":"Hex","purl":"pkg:hex/phoenix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0-rc.0"},{"fixed":"1.7.24"}]}],"versions":["1.7.0","1.7.0-rc.0","1.7.0-rc.1","1.7.0-rc.2","1.7.0-rc.3","1.7.1","1.7.10","1.7.11","1.7.12","1.7.13","1.7.14","1.7.15","1.7.16","1.7.17","1.7.18","1.7.19","1.7.2","1.7.20","1.7.21","1.7.22","1.7.23","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6983-jfq8-485w/GHSA-6983-jfq8-485w.json"}},{"package":{"name":"phoenix","ecosystem":"Hex","purl":"pkg:hex/phoenix"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0-rc.0"},{"fixed":"1.8.9"}]}],"versions":["1.8.0","1.8.0-rc.0","1.8.0-rc.1","1.8.0-rc.2","1.8.0-rc.3","1.8.0-rc.4","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6983-jfq8-485w/GHSA-6983-jfq8-485w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}