Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-109821— Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Quick assessment

Affected

elixir-lang elixir

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elixir 标准库中的 URI 模块存在“输入中指定数量验证不当”的漏洞。攻击者通过提供恶意构造的 URL，可导致 CPU 资源耗尽，从而引发拒绝服务（DoS）攻击。具体而言，函数在（位于）中调用将端口号转换为整数时，未对输入长度进行限制。因此，攻击者可构造一个长达 1,262,592 位十进制数字的端口号，生成对应大小的大整数（bignum）；若端口号更长，则会抛出。当将解析后的 URI 重新转换为文本（例如通过、、日志记录或错误格式化）时，系统会调用将该大整数转换为二进制字符串。在 Erla

CVSS 6.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1284

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
elixir-lang	elixir	0.5.0 ~ 1.18.6	`cpe:2.3:a:elixir-lang:elixir::::::::`
elixir-lang	elixir	39801821eef2d06524e5ebf5a0e4b3c380ad23ae ~ *	`cpe:2.3:a:elixir-lang:elixir::::::::`

II. Public POCs for CVE-2026-109821

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109821

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109821 (1)

🔗 stdlib: Denial-of-Service enabled by Unbounded Integer Conversion · Advisory · erlang/otp · GitHub Read full article related

Other References for CVE-2026-109821 (8)

https://www.cve.org/CVERecord?id=CVE-2026-109821

Same Patch Batch · elixir-lang · 2026-10-30 · 3 CVEs total

CVE-2026-115274	6.9 MEDIUM	Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of ser
CVE-2026-97209	5.4 MEDIUM	Insecure temporary file in mix deps.partition lets a local user execute code in another us

IV. Related Vulnerabilities

Same product: elixir

Same vendor: elixir-lang

Same weakness: CWE-1284