CVE-2026-115274

Name of the Vulnerable Software and Affected Versions elixir versions 1.18.0-rc.0 through 1.18.5 elixir versions 1.19.0-rc.0 through 1.19.6 elixir versions 1.20.0-rc.0 through 1.20.4

Description Improper validation of specified quantity in input within the Elixir standard library's JSON module allows an unauthenticated attacker to cause a denial of service through CPU and memory exhaustion by supplying a specially crafted JSON document. The functions JSON.decode/1 and JSON.decode!/1 use erlang:binary to integer/1 to convert integer literals without bounding their length. Consequently, an integer literal with one million digits consumes 100 to 300 times more CPU than a string of the same length, and literals exceeding approximately 1.29 million digits trigger a SystemLimitError. Applications generated by phx.new are particularly susceptible as they decode request bodies using Plug.Parsers before routing and authentication occur.

Recommendations Update elixir to version 1.18.6 or later. Update elixir to version 1.19.7 or later. Update elixir to version 1.20.5 or later. As a temporary mitigation, decode untrusted JSON using a custom integer decoder that rejects long digit runs before conversion. In Phoenix applications, replace Phoenix.json library() with a safe JSON decoder in Plug.Parsers to restrict the length of integer literals.