{"id":"CVE-2026-115274","kind":"vulnerability","aliases":["CVE-2026-115274"],"related":[],"title":"Elixir: unbounded JSON integer parsing lets a request exhaust CPU and memory","description":"Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.","summary":"The Elixir standard library's JSON module converts integer literals of any length without a bound, so a single large JSON body can hold a scheduler for about a second. An unauthenticated attacker can cause denial of service by sending such a document to an exposed endpoint.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","phoenix","plug","runtime","self-hosted"],"not_affected_if":["static-export","trusted-input-only"],"how_to_check":"- Run `elixir --version` and compare the Elixir version with the affected ranges.\n- Look for `JSON.decode` or `JSON.decode!` calls, and for Phoenix apps generated by `phx.new` that parse request bodies with JSON in Plug.Parsers.","fix":"- Elixir `1.18.6` or later for the 1.18 line\n- Elixir `1.19.7` or later for the 1.19 line\n- Elixir `1.20.5` or later for the 1.20 line","status":"open","published_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:38+00:00","triaged_at":"2026-10-30T09:30:36+00:00","updated_at":"2026-10-30T09:30:36+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T09:30:36Z","model":"claude-haiku-5-5","output":{"fix":"- Elixir `1.18.6` or later for the 1.18 line\n- Elixir `1.19.7` or later for the 1.19 line\n- Elixir `1.20.5` or later for the 1.20 line","reach":"internet","title":"Elixir: unbounded JSON integer parsing lets a request exhaust CPU and memory","impact":"low","summary":"The Elixir standard library's JSON module converts integer literals of any length without a bound, so a single large JSON body can hold a scheduler for about a second. An unauthenticated attacker can cause denial of service by sending such a document to an exposed endpoint.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["elixir","phoenix","plug","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker exhausts CPU and memory, causing denial of service on the endpoint.","analyst_note":"","how_to_check":"- Run `elixir --version` and compare the Elixir version with the affected ranges.\n- Look for `JSON.decode` or `JSON.decode!` calls, and for Phoenix apps generated by `phx.new` that parse request bodies with JSON in Plug.Parsers.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","static-export"],"who_is_affected":"Applications that use Elixir's built-in JSON module to decode untrusted request bodies are exposed, and Phoenix apps generated by phx.new parse JSON in Plug.Parsers before routing and authentication, so they are reachable without credentials. Batch jobs and services that only decode trusted local data can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4354,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115274':15A,18A '-2026':14A,17A '/1':111C,114C '1.18.0':200C '1.18.6':203C '1.19.0':205C '1.19.7':208C '1.20.0':211C '1.20.5':214C '1.29':175C '100':140C '300':142C 'affect':197C 'allow':89C 'applic':180C 'attack':58B,92C 'authent':194C 'binari':121C 'bodi':47B,157C,186C 'bound':41B,127C 'caus':60B,99C 'convert':33B,115C 'cost':139C 'cpu':10A,105C,146C 'cve':13A,16A 'decod':136C,184C 'denial':61B,101C 'digit':135C,177C 'document':68B,97C 'elixir':1A,19B,27B,83C,198C 'endpoint':72B 'erlang':120C 'exhaust':9A,108C 'expos':71B 'generat':181C 'hold':49B,162C 'host':25B 'improp':73C 'input':79C 'integ':4A,34B,117C 'integer/1':123C 'issu':196C 'json':3A,31B,46B,87C,96C,188C 'json.decode':110C,113C 'json.decode/1':109C 'larg':45B 'length':38B,129C,153C 'let':6A 'librari':29B,85C 'liter':35B,118C,131C,170C 'megabyt':161C 'memori':12A,107C 'million':134C,176C 'modul':32B,88C 'much':145C 'one':133C,155C 'pars':5A 'phoenix':20B 'phx.new':183C 'plug':21B 'plug.parsers':190C 'quantiti':77C 'rais':178C 'rc.0':201C,206C,212C 'request':8A,156C,185C 'rout':192C 'runtim':22B 'schedul':51B,164C 'second':55B,168C 'self':24B 'self-host':23B 'send':65B 'servic':63B,103C 'singl':44B 'specifi':76C 'standard':28B,84C 'string':149C 'success':137C 'suppli':94C 'systemlimiterror':179C 'time':143C 'unauthent':57B,91C 'unbound':2A 'valid':74C 'vulner':80C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Applications that use Elixir's built-in JSON module to decode untrusted request bodies are exposed, and Phoenix apps generated by phx.new parse JSON in Plug.Parsers before routing and authentication, so they are reachable without credentials. Batch jobs and services that only decode trusted local data can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115274","severity":null,"published_at":"2026-10-30T09:17:14+00:00","modified_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:38+00:00","fetched_at":"2026-10-30T09:29:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}