A critical denial of service vulnerability in mtrudel bandit allows unauthenticated attackers to exhaust CPU resources through malicious WebSocket traffic.

This is an inefficient algorithmic complexity flaw (CWE-407) triggered during the reassembly of WebSocket fragments. The vulnerability is exploitable by unauthenticated remote attackers.

Exploitation results in high impact to service availability, as the CPU exhaustion will render the application unresponsive to legitimate requests. With a CVSS score of 8.7, this vulnerability presents a significant risk to operational continuity, especially for services relying on WebSocket communication.

Immediate Action: Update mtrudel bandit to version 1.12.1 or higher to resolve the algorithmic complexity issue.

Proactive Monitoring: Monitor server CPU utilization and inspect logs for unusually high volumes of fragmented WebSocket traffic that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Implement rate limiting and request size restrictions on WebSocket endpoints via a load balancer or WAF to mitigate the impact of resource-intensive connection attempts.

Public Exploit Available: Unknown.

Given the potential for remote denial of service and the existence of a proof-of-concept, users should treat this as a high-priority update. Apply the patch to version 1.12.1 immediately to restore resource management stability.