Read the docs
TI-2026-82968 Aliases CVE-2026-109821

Unbounded port parsing in Elixir URI.parse/1 enables CPU exhaustion

Priority MEDIUM 61CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

The URI module in Elixir from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7 and from 1.20.0-rc.0 before 1.20.5 parses ports without bounding their length. URI.parse/1 converts the port without a length limit, and rendering the result is quadratic on Erlang/OTP 27, 28 and 29.0, which causes CPU exhaustion (CWE-1284). A remote unauthenticated attacker who supplies a URL can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00496 42nd percentileScored 2026-11-07
Fix Fixed elixir (elixir-lang): 1.18.6, 1.19.7, 1.20.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-langelixir0.5.0 to before 1.18.6; 1.19.0-rc.0 to before 1.19.7; 1.20.0-rc.0 to before 1.20.51.18.6, 1.19.7, 1.20.5Patch availableCNA
  • elixir Vendorelixir-lang Affected 0.5.0 to before 1.18.6; 1.19.0-rc.0 to before 1.19.7; 1.20.0-rc.0 to before 1.20.5 Fixed in 1.18.6, 1.19.7, 1.20.5 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fixed versions are elixir 1.18.6, 1.19.7 and 1.20.5. The sources list no fixed version for elixir.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA elixir (elixir-lang) Fixed in 1.18.6, 1.19.7, 1.20.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    elixir-lang elixir 1.18.6, 1.19.7, 1.20.5

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-82969 Elixir JSON.decode lets huge integers exhaust CPU and memoryPriority HIGH 70
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-109821
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Patch 4

Advisory 1

Other 4

  • TI-2026-82969 Elixir JSON.decode lets huge integers exhaust CPU and memory CVSS 4.0MEDIUM 6.9
  • TI-2026-82970 Insecure temporary file in Mix deps.partition enables code execution CVSS 4.0MEDIUM 5.4
  • TI-2026-53033 Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir CVSS 4.0MEDIUM 5.9
  • TI-2026-36671 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences