Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115274— Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Quick assessment

Affected
elixir-lang elixir
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elixir 标准库的 JSON 模块中存在“输入中指定数量验证不当”的漏洞。该漏洞允许未认证的攻击者通过提交恶意构造的 JSON 文档，引发 CPU 和内存耗尽，从而导致拒绝服务（DoS）。 具体而言， 和 函数在解析整数字面量时，会调用 ，且未对字面量的长度进行限制。一个包含一百万位数字的整数字面量虽能成功解码，但其 CPU 消耗量是同长度字符串的 100 至 300 倍。因此，仅需几兆字节大小的请求体，即可使调度器阻塞约一秒。当整数字面量超过约 129 万位时，则会抛出 。 由 生成的应用程序会在路由和身份验

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115274

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-lang elixir 1.18.0-rc.0 ~ 1.18.6 cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*
elixir-lang elixir 793c1147210388587defb649f25f293ffbfa6b1b ~ * cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-115274

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115274

请登录查看更多情报信息。

Other References for CVE-2026-115274 (8)

Same Patch Batch · elixir-lang · 2026-10-30 · 3 CVEs total

CVE-2026-109821 6.3 MEDIUM Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
CVE-2026-97209 5.4 MEDIUM Insecure temporary file in mix deps.partition lets a local user execute code in another us

IV. Related Vulnerabilities

Same product: elixir
Same vendor: elixir-lang
Same weakness: CWE-1284