CVE-2026-59696

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 21.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 stdlib versions 3.5 through 6.2.2.4 stdlib versions 7.0 through 7.3.0.1 stdlib versions 8.0 through 8.0.3

Description Improper validation of input quantity in the stdlib allows a remote attacker to degrade availability by providing a URI with a port component consisting of an excessively long sequence of digits. The function uri string:get port/1 passes the port substring to binary to integer/1 without a length bound. Consequently, a syntactically valid port of up to approximately 1.26 million digits can be converted successfully, consuming hundreds of milliseconds of arbitrary-precision arithmetic in the calling process. This conversion is triggered via every authority-parsing path in uri string:parse/1, including host, registered-name, and IPv4 and IPv6 forms. Any application using uri string:parse/1 to parse attacker-supplied URIs is exposed.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Update stdlib to version 6.2.2.5 or later. Update stdlib to version 7.3.0.2 or later. Update stdlib to version 8.0.4 or later.