CVE-2026-56811: Phoenix Framework Denial of Service via Unbounded Channel Joins
Summary
CVE-2026-56811: Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Ph... Affects phoenix across 8 version ranges.
>= 0.11.0, < 1.5.15
>= 1.6.0-rc.0, < 1.6.17
>= 1.7.0-rc.0, < 1.7.24
>= 1.8.0-rc.0, < 1.8.9
>= 14a297e88023cb280a577962a49a0bbdeef9f4eb, < c498ba8cf49f6accbbd0c643a5340b58db891218
< 16e295d2fccab185d1292322e2bee5d46c725c8a
< a612100cd8a4279091abc1a2ef8fb98a6d01c0a1
< d19ca0a8d9f82c130b7ed339b9f033433e2dea5e
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Phoenix is a web framework for the Elixir programming language, designed for building scalable and maintainable applications. It provides real-time features through channels, allowing for efficient communication between clients and servers. However, a recent vulnerability has been identified that affects the way Phoenix handles channel joins, potentially leading to denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability in the Phoenix.Socket module allows unauthenticated attackers to exploit the channel joining mechanism. Specifically, the lack of limits on the number of channels a single transport process can join enables an attacker to send multiple phx_join messages over a single connection. This can spawn an excessive number of channel processes, eventually exhausting the BEAM process limit and denying service to legitimate users. The vulnerability is present in versions of Phoenix from 0.11.0 to before 1.5.15, from 1.6.0-rc.0 to before 1.6.17, from 1.7.0-rc.0 to before 1.7.24, and from 1.8.0-rc.0 to before 1.8.9.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.11.0, < 1.5.151.5.15 -
>= 1.6.0-rc.0, < 1.6.171.6.17 -
>= 1.7.0-rc.0, < 1.7.241.7.24 -
>= 1.8.0-rc.0, < 1.8.91.8.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can front the socket endpoint with a reverse proxy that limits the number and rate of channel-join frames per connection. Additionally, consider disabling unnecessary transports, such as LongPoll, by removing longpoll: true from your socket declaration. Example:
socket '/socket', Phoenix.Socket,
longpoll: false
Conclusion
CVE-2026-56811 presents a significant risk to applications using the Phoenix framework due to its potential for denial of service attacks. It is crucial for developers to update to the latest patched versions and consider implementing workarounds to mitigate the risk until they can fully address the vulnerability.
See every vulnerability recorded for phoenix →
FAQ
CVE-2026-56811 is a vulnerability in the Phoenix framework that allows unauthenticated attackers to cause denial of service by exploiting unbounded channel joins.
The vulnerability affects Phoenix versions from 0.11.0 to before 1.5.15, from 1.6.0-rc.0 to before 1.6.17, from 1.7.0-rc.0 to before 1.7.24, and from 1.8.0-rc.0 to before 1.8.9.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
If immediate updating is not possible, implement the suggested workarounds, such as using a reverse proxy to limit channel-join requests or disabling unnecessary transports.
Related vulnerabilities
Recent vulnerabilities recorded for phoenix.
