Phoenix — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in the Phoenix web framework for Elixir. One fires on every channel broadcast (event intercept list scan per subscriber); the other fires at router compile time (pipe_through deduplication). Patches ready for upstream review.

The Defects

phoenix-0001 (PATCHED — HIGH): channel/server.ex:443

# event_intercepts: list
# Per broadcast, per subscriber:
if event in event_intercepts do  # O(K) list scan per subscriber per broadcast
  ...
end

event_intercepts is a list. The in operator performs a linear scan over K intercepted events for every subscriber on every broadcast message. For N subscribers and K intercepts: O(N × K) per broadcast.

phoenix-0002 (PATCHED — MEDIUM): router.ex

# pipe_through duplicate check during router compilation:
if pipe in pipes do  # O(P) list scan per pipe per pipeline
  ...
end

pipes is a list. O(P) scan per pipe_through() call during router compilation. For P pipelines: O(P²) compile-time cost.

Complexity Proof

phoenix-0001: For N=1000 subscribers, K=6 intercepts per broadcast:

Per broadcast: N × K = 6,000 list comparisons
Fixed: N × O(1) MapSet lookups
Measured ratio: 6× (scales with N×K product).

phoenix-0002: For P=72 pipelines:

Compile-time: O(P²) = 5,184 comparisons vs 72 set ops
Measured ratio: 72×.

Impact

phoenix-0001 affects every Phoenix Channels application — real-time features, LiveView, WebSocket endpoints. Large chat rooms, multiplayer games, and live dashboards with many subscribers and event intercepts hit worst case on every broadcast.

phoenix-0002 affects every Phoenix application at compile time. Router recompilation (code reloads in development, releases in production) hits O(P²) dedup.

The Fix

phoenix-0001: Replace event_intercepts list with MapSet:

# Before
if event in event_intercepts do ... end

# After
# CWE-407 fix: MapSet for O(1) member? instead of O(K) list scan.
if MapSet.member?(event_intercepts_set, event) do ... end

phoenix-0002: Replace pipes list with MapSet in pipe_through dedup.

Patch

defects/phoenix/patch/phoenix-0001-0002-mapset-intercepts.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your channel and router test suites.
Assess CVE eligibility — phoenix-0001 fires on every broadcast in a multi-subscriber channel.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.7 KiB Raw Blame History Unescape Escape