Unknown · Erlang/Otp · CVE-2026-59696
**Name of the Vulnerable Software and Affected Versions**
Erlang/OTP versions 21.0 through 27.3.4.16
Erlang/OTP versions 28.0 through 28.5.0.5
Erlang/OTP versions 29.0 through 29.0.5
stdlib versions 3.5 through 6.2.2.4
stdlib versions 7.0 through 7.3.0.1
stdlib versions 8.0 through 8.0.3
**Description**
Improper validation of input quantity in the stdlib allows a remote attacker to degrade availability by providing a URI with a port component consisting of an excessively long sequence of digits. The function `uri string:get port/1` passes the port substring to `binary to integer/1` without a length bound. Consequently, a syntactically valid port of up to approximately 1.26 million digits can be converted successfully, consuming hundreds of milliseconds of arbitrary-precision arithmetic in the calling process. This conversion is triggered via every authority-parsing path in `uri string:parse/1`, including host, registered-name, and IPv4 and IPv6 forms. Any application using `uri string:parse/1` to parse attacker-supplied URIs is exposed.
**Recommendations**
Update Erlang/OTP to version 27.3.4.17 or later.
Update Erlang/OTP to version 28.5.0.6 or later.
Update Erlang/OTP to version 29.0.6 or later.
Update stdlib to version 6.2.2.5 or later.
Update stdlib to version 7.3.0.2 or later.
Update stdlib to version 8.0.4 or later.