CVE-2026-75758— Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

Quick assessment

Affected

elixir-lang elixir

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

The Elixir programming language Elixir是The Elixir programming language社区的一款编程语言。 The Elixir programming language Elixir 1.18.5版本之前的1.15.0-rc.0版本、1.19.6版本之前的1.19.0-rc.0版本和1.20.4版本之前的1.20.0-rc.0版本存在资源管理错误漏洞，该漏洞源于Inspect.List组件的charlist分支对列表分类不当，List.ascii_p

CVSS 5.9 · Medium EPSS 0.18% · P7 Updated Aug 29, 2026

Possible ATT&CK Techniques 1 AI

T1480 · Execution Guardrails

Affected Version Matrix 4

Vendor	Product	Version Range	Status
elixir-lang	elixir	`1.15.0-rc.0< 1.18.5`	affected
		`1.19.0-rc.0< 1.19.6`	affected
		`1.20.0-rc.0< 1.20.4`	affected
		`9718f2b90ce086ff8614d5782f4ec528495c98dd< *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75758

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

Source: CVE Program / CVE List V5

Vulnerability Description

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape. Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs. This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

未经控制的递归

Source: CVE Program / CVE List V5

Vulnerability Title

The Elixir programming language Elixir 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
elixir-lang	elixir	1.15.0-rc.0 ~ 1.18.5	`cpe:2.3:a:elixir-lang:elixir::::::::`
elixir-lang	elixir	9718f2b90ce086ff8614d5782f4ec528495c98dd ~ *	`cpe:2.3:a:elixir-lang:elixir::::::::`