Live › vulnerability › CVE-2026-109821
Elixir's URI.parse/1 accepts a port with up to about 1.26 million digits and converts it to a huge integer, and rendering that integer back to text is quadratic on Erlang/OTP 27, 28 and 29.0. An attacker who supplies a crafted URL can tie up the CPU for seconds per request, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Any application that parses attacker-supplied URLs with Elixir's URI.parse/1 and then renders or logs the result is exposed. Systems that only handle trusted URLs, or that run an unaffected Elixir release, can skip it.
No product ranges from the sources yet.
elixir --version; affected releases are before 1.18.6, 1.19.0-rc.0 to before 1.19.7, and 1.20.0-rc.0 to before 1.20.5.erl -noshell -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().'; OTP 27, 28 and 29.0 are the affected runtimes.URI.parse/1 on user-supplied URLs.1.18.6, 1.19.7, or 1.20.5 (or later in the same series).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.
URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.
This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-109821")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.