Live › vulnerability › CVE-2026-115274
The Elixir standard library's JSON module converts integer literals of any length without a bound, so a single large JSON body can hold a scheduler for about a second. An unauthenticated attacker can cause denial of service by sending such a document to an exposed endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Applications that use Elixir's built-in JSON module to decode untrusted request bodies are exposed, and Phoenix apps generated by phx.new parse JSON in Plug.Parsers before routing and authentication, so they are reachable without credentials. Batch jobs and services that only decode trusted local data can skip it.
No product ranges from the sources yet.
elixir --version and compare the Elixir version with the affected ranges.JSON.decode or JSON.decode! calls, and for Phoenix apps generated by phx.new that parse request bodies with JSON in Plug.Parsers.1.18.6 or later for the 1.18 line1.19.71.20.5 or later for the 1.20 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-115274")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.