CVE-2026-32689Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix
- 8.7HighCVSS base score
- 0.47%Exploitation in 30 daysEPSS · top 59% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling. In 'Elixir.Phoenix.Transports.LongPoll':publish/4, when a POST request is received with Content-Type: application/x-ndjson, the request body is split on newline characters using String.split/2 with no limit on the number of resulting segments. An attacker can send a body consisting entirely of newline bytes, causing a 1:1 amplification into a list of empty binaries — a 1 MB body produces approximately one million list elements, an 8 MB body approximately 8.4 million. Each element is then walked by Enum.map, materializing another list of the same size. This exhausts BEAM memory and schedulers, crashing the node and terminating all active sessions. A session token required to reach the vulnerable endpoint is freely obtainable by any client via an unauthenticated GET request to the same URL with a matching Origin header, making this attack effectively unauthenticated. This issue affects phoenix: from 1.7.0 before 1.7.22 and 1.8.6.
Timeline
ID reserved
By EEF
- 53 days later
· 53 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Deferred | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.47% · top 59% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Affected products
- affected 1.7.0 – < 1.7.22
- affected 1.8.0 – < 1.8.6
- affected 2674c6ea30634667f9b09966b90269393b445953 – < *
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- HexphoenixGHSA-628h-q48j-jr6q (opens in a new tab)
What to do
Workaround: Disable the longpoll transport on all Phoenix.Socket declarations, including the LiveView /live socket, by removing or setting longpoll: false. Note that this prevents clients that cannot use WebSockets from connecting.
References
References5
- https://github.com/phoenixframework/phoenix/security/advisories/GHSA-628h-q48j-jr6q (opens in a new tab)vendor-advisoryrelated
- https://cna.erlef.org/cves/CVE-2026-32689.html (opens in a new tab)related
- https://osv.dev/vulnerability/EEF-CVE-2026-32689 (opens in a new tab)related
- https://github.com/phoenixframework/phoenix/commit/1a67c61ff9ce0a7711662ac7354861917a7c80f7 (opens in a new tab)patch
- https://github.com/phoenixframework/phoenix/commit/912ea181fd247c21dbcc49fb97d0053b947d81bf (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-27339 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-628h-q48j-jr6q (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-32689)Record last updated .