CVE-2026-109821
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 without bounding its length.
Risk Assessment
A port of up to 1,262,592 decimal digits produces a bignum of that size, and rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0. A 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds.
Recommendation
Upgrade Elixir to version 1.18.6, 1.19.7, or 1.20.5 (or later) depending on the branch in use. Until deployed, consider validating and limiting port lengths in incoming URLs.
Other vulnerabilities in Elixir
See all- CVE-2026-115274Medium
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length.
- CVE-2026-75758Medium
Uncontrolled recursion in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. The issue stems from misclassification of a list as a charlist, leading to recursive exception raising and stack growth until memory exhaustion.
- CVE-2026-49762Medium
The Version module in the Elixir standard library (versions from 0.9.3 before 1.20.1) is vulnerable to uncontrolled resource consumption. An attacker controlling a version string can cause a denial of service through CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, leading to super-linear conversion and process crashes.
Original NVD description (English source)
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS