Read the docs
TI-2026-82969 Aliases CVE-2026-115274

Elixir JSON.decode lets huge integers exhaust CPU and memory

Priority HIGH 70CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The Elixir standard library JSON module in elixir from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7 and from 1.20.0-rc.0 before 1.20.5 does not bound integer literal length (CWE-1284). JSON.decode/1 converts each literal without a limit, so a very long integer costs far more CPU than a string of the same length. An unauthenticated remote attacker who supplies a JSON document can exhaust CPU and memory, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Fix Fixed elixir (elixir-lang): 1.18.6, 1.19.7, 1.20.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-langelixir1.18.0-rc.0 to before 1.18.6; 1.19.0-rc.0 to before 1.19.7; 1.20.0-rc.0 to before 1.20.51.18.6, 1.19.7, 1.20.5Patch availableCNA
  • elixir Vendorelixir-lang Affected 1.18.0-rc.0 to before 1.18.6; 1.19.0-rc.0 to before 1.19.7; 1.20.0-rc.0 to before 1.20.5 Fixed in 1.18.6, 1.19.7, 1.20.5 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade elixir to 1.18.6, 1.19.7 or 1.20.5, matching the release line in use.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA elixir (elixir-lang) Fixed in 1.18.6, 1.19.7, 1.20.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    elixir-lang elixir 1.18.6, 1.19.7, 1.20.5

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-82968 Unbounded port parsing in Elixir URI.parse/1 enables CPU exhaustionPriority MEDIUM 61
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-115274
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → HIGH
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 4

Advisory 1

Other 3

  • TI-2026-82968 Unbounded port parsing in Elixir URI.parse/1 enables CPU exhaustion CVSS 4.0MEDIUM 6.3
  • TI-2026-82970 Insecure temporary file in Mix deps.partition enables code execution CVSS 4.0MEDIUM 5.4
  • TI-2026-53033 Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir CVSS 4.0MEDIUM 5.9
  • TI-2026-36671 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences