GHSA-6983-jfq8-485w Phoenix: Unbounded channel joins per transport enables DoS over few connections

• Hex phoenix: >= 0.11.0, < 1.5.15 → fixed in 1.5.15 • Hex phoenix: >= 1.6.0-rc.0, < 1.6.17 → fixed in 1.6.17 • Hex phoenix: >= 1.7.0-rc.0, < 1.7.24 → fixed in 1.7.24 • Hex phoenix: >= 1.8.0-rc.0, < 1.8.9 → fixed in 1.8.9

Summary Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily. Impact An unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.