CVE-2026-59696
Received Received - Intake

Denial of Service in Erlang/OTP stdlib

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility. This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-59696
EUVD
EUVD-2026-69229

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
erlang otp to 27.3.4.17 (exc)
erlang otp to 28.5.0.6 (exc)
erlang otp to 29.0.6 (exc)
erlang stdlib to 6.2.2.5 (exc)
erlang stdlib to 7.3.0.2 (exc)
erlang stdlib to 8.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper input validation issue in Erlang/OTP's stdlib. A remote attacker can degrade system availability by providing a URI with an extremely long port number (up to 1.26 million digits). The uri_string:get_port/1 function converts this port substring to an integer without length restrictions, causing the process to perform costly arbitrary-precision arithmetic, slowing down the system.

Detection Guidance

To detect this vulnerability, monitor for processes consuming excessive CPU due to URI parsing. Check Erlang/OTP versions with `erl -version` and compare against affected ranges (OTP 21.0 to 27.3.4.16, 28.0 to 28.5.0.5, 29.0 to 29.0.5). Inspect logs for applications parsing URIs from untrusted sources.

Impact Analysis

If you use an affected version of Erlang/OTP stdlib, an attacker could send a malicious URI to your application, causing high CPU usage and degraded performance. This could lead to denial-of-service conditions, making your services slow or unresponsive.

Compliance Impact

This vulnerability primarily impacts system availability due to resource exhaustion, which could lead to service disruptions. GDPR and HIPAA require maintaining system availability and protecting data integrity, so prolonged downtime may violate compliance if it affects data processing or access. However, this CVE does not directly impact confidentiality or integrity, so standard data protection controls remain unaffected.

Mitigation Strategies

Upgrade Erlang/OTP to patched versions (27.3.4.17+, 28.5.0.6+, 29.0.6+). If upgrading is not possible, implement input validation for URIs before parsing, limiting port digits to a reasonable length (e.g., 5 digits).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart