CVE-2026-109821

Name of the Vulnerable Software and Affected Versions Elixir versions 0.5.0 through 1.18.5 Elixir versions 1.19.0-rc.0 through 1.19.6 Elixir versions 1.20.0-rc.0 through 1.20.4

Description An improper validation of input quantity in the URI module of the Elixir standard library allows an attacker to cause a denial of service through CPU exhaustion by supplying a URL with an excessively long port component. The URI.parse/1 function uses String.to integer/1 within split authority/1 to convert the port without bounding its length, allowing the creation of a bignum (a large integer) of up to 1,262,592 decimal digits. When this parsed URI is rendered back to text via URI.to string/1, inspect/1, logging, or error formatting, it utilizes :erlang.integer to binary/1. On Erlang/OTP 27, 28, and 29.0, this conversion process is quadratic, meaning the CPU time required increases significantly as the number of digits grows. For example, a port with 400,000 digits can take approximately 2.6 seconds to render, while a 1 MB port can take about 18 seconds. This can lead to CPU exhaustion on servers that parse and subsequently log or echo user-supplied URLs provided in form or JSON body fields.

Recommendations Update Elixir to version 1.18.6 or later. Update Elixir to version 1.19.7 or later. Update Elixir to version 1.20.5 or later. As a temporary workaround, reject URLs that exceed a few kilobytes in length before parsing. As a temporary workaround, validate and reject any parsed port value exceeding 65535 before rendering or using the %URI{} object.