CVE-2026-109821
Received Received - Intake

Denial of Service in Elixir URI Module

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-109821
EUVD
EUVD-2026-113757

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elixir-lang elixir 0.5.0
elixir-lang elixir 1.19.0-rc.0
elixir-lang elixir 1.20.0-rc.0
elixir-lang elixir 39801821eef2d06524e5ebf5a0e4b3c380ad23ae

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation in Elixir's URI.parse/1 function. An attacker can supply a URL with an extremely long port number (up to 1,262,592 digits), causing CPU exhaustion. The function converts the port to an integer without length limits, creating a very large bignum. When the URI is later rendered back to text, the conversion process is computationally expensive, especially on Erlang/OTP versions 27, 28, and 29.0, leading to multi-second delays per request.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage when parsing URLs in Elixir applications. Check logs for requests containing extremely long port numbers (e.g., 1,262,592 digits). Use network monitoring tools to identify clients sending malformed URLs. Test URI parsing with intentionally long port strings to observe performance degradation.

Impact Analysis

This vulnerability can impact you by causing denial of service through CPU exhaustion. Applications parsing user-supplied URLs with long ports may experience significant slowdowns or crashes. Attackers could exploit this to degrade service performance or take systems offline by submitting maliciously crafted URLs.

Mitigation Strategies

Upgrade Elixir to versions 1.18.6, 1.19.7, or 1.20.5 or later. Implement input validation to reject URLs with ports exceeding 65535 or containing more than 6 digits. Use URI.new/1 instead of URI.parse/1 where possible. Apply patches for Erlang/OTP versions 27, 28, and 29.0 to address quadratic-time conversion issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart