CVE-2026-115274
Received Received - Intake

Denial of Service in Elixir JSON Decoding

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-115274
EUVD
EUVD-2026-113758

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elixir-lang elixir 1.18.0-rc.0
elixir-lang elixir 1.19.0-rc.0
elixir-lang elixir 1.20.0-rc.0
elixir-lang elixir 793c1147210388587defb649f25f293ffbfa6b1b

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper input validation issue in Elixir's JSON module where the JSON.decode/1 and JSON.decode!/1 functions do not limit the length of integer literals during parsing. Attackers can send JSON documents with extremely large integers (e.g., one million digits), causing excessive CPU and memory usage, leading to denial of service. The issue affects Elixir versions 1.18.0-rc.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, and 1.20.0-rc.0 to 1.20.4.

Detection Guidance

Monitor for unusually high CPU or memory usage during JSON parsing. Check Elixir application logs for errors like 'integer_too_large' or 'SystemLimitError' when processing large integers. Use network traffic analysis tools to detect requests with excessively large integer literals in JSON payloads.

Impact Analysis

An attacker can exploit this to consume significant server resources, causing slowdowns or crashes. Applications using Phoenix framework are particularly vulnerable since JSON is decoded before authentication. A single malicious request could occupy a server scheduler for about a second, potentially disrupting service for other users.

Compliance Impact

This vulnerability primarily causes denial of service through CPU and memory exhaustion, which could impact system availability. While it does not directly violate GDPR or HIPAA, repeated DoS attacks could lead to service disruptions that may affect compliance with availability requirements in these regulations. Organizations must ensure their Elixir applications are patched to prevent such disruptions.

Mitigation Strategies
  • Upgrade Elixir to patched versions (1.18.6, 1.19.7, or 1.20.5) immediately.
  • Implement a custom JSON decoder with a digit limit (e.g., 1024 digits) for integers as a temporary workaround.
  • Configure Plug.Parsers in Phoenix applications to enforce stricter body size limits and validate JSON content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart