CVE-2026-75758

Name of the Vulnerable Software and Affected Versions Elixir versions 1.15.0-rc.0 through 1.18.4 Elixir versions 1.19.0-rc.0 through 1.19.5 Elixir versions 1.20.0-rc.0 through 1.20.3

Description An uncontrolled recursion issue in the standard library allows an attacker who controls a list passed to the inspect/1, List.to string/1, or List.to charlist/1 functions to exhaust the memory of a BEAM node. The problem occurs when a list's printable prefix exceeds the :printable limit (default 4096 elements) but contains a subsequent element that is not a valid code point, such as an atom or an out-of-range integer. This causes the list to be misclassified as a charlist, leading to an ArgumentError. In List.to string/1 and List.to charlist/1, the rescue clause attempts to build an error message by calling inspect(list), which re-triggers the same error path. Because this recursion is not in tail position, the process stack grows until the node runs out of memory or the process is killed by max heap size.

Recommendations Update Elixir to version 1.18.5 or later. Update Elixir to version 1.19.6 or later. Update Elixir to version 1.20.4 or later. As a temporary workaround, install a global inspect function via the application start callback using Inspect.Opts.default inspect fun/1 with fn term, opts -> Inspect.inspect(term, %{opts | charlists: :as lists}) end to prevent the charlist branch from being entered.