---
id: "CVE-2026-109821"
kind: "vulnerability"
aliases: ["CVE-2026-109821"]
title: "Elixir URI module: long port numbers cause CPU exhaustion denial of service"
severity: "medium"
cvss: 6.3
epss: 0.00496
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["elixir", "erlang-otp", "runtime", "web-services"]
not_affected_if: ["trusted-input-only", "unaffected-elixir-version"]
published_at: "2026-10-30T09:17:12+00:00"
first_seen_at: "2026-10-30T09:29:38+00:00"
updated_at: "2026-10-30T18:23:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109821", "first_seen_at": "2026-10-30T09:29:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109821", "first_seen_at": "2026-10-30T18:23:38+00:00"}]
---

# Elixir URI module: long port numbers cause CPU exhaustion denial of service

Elixir's URI.parse/1 accepts a port with up to about 1.26 million digits and converts it to a huge integer, and rendering that integer back to text is quadratic on Erlang/OTP 27, 28 and 29.0. An attacker who supplies a crafted URL can tie up the CPU for seconds per request, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Elixir version with `elixir --version`; affected releases are before `1.18.6`, `1.19.0-rc.0` to before `1.19.7`, and `1.20.0-rc.0` to before `1.20.5`.
- Check the Erlang/OTP version with `erl -noshell -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().'`; OTP 27, 28 and 29.0 are the affected runtimes.
- Find code paths that call `URI.parse/1` on user-supplied URLs.

## Fix

- elixir: move to `1.18.6`, `1.19.7`, or `1.20.5` (or later in the same series).

## Timeline

- 2026-10-30T09:29:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109821
- 2026-10-30T18:23:38+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109821

## From the sources

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.

URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.

This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_