Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir
Impact
Elixir versions 0.5.0 to 1.18.6, 1.19.0-rc.0 to 1.19.7, and 1.20.0-rc.0 to 1.20.5 have an improper validation vulnerability, allowing an attacker to cause CPU exhaustion denial of service by supplying a URL with a large port number. The weakness affects the URI module's port parsing. An attacker must supply a malicious URL to exploit this vulnerability.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Reject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed port above 65535 before rendering or using the %URI{}. URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where :uri_string limits the port to 5 digits.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
elixir-lang · EEF
elixir
3 ranges
elixir-lang · EEF
elixir
Package identity
pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.5.0 → before 1.18.6
semver versions
1.19.0-rc.0 → before 1.19.7
semver versions
1.20.0-rc.0 → before 1.20.5
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*elixir-lang · EEF
elixir
1 range
elixir-lang · EEF
elixir
Package identity
pkg:github/elixir-lang/elixirIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
39801821eef2d06524e5ebf5a0e4b3c380ad23ae → before *
git versions
From 9a39d64a4473d02681c486bc70681c972479d32b: unaffected
From b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58: unaffected
From 07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7: unaffected
From d879b39d778fec2f475689573d5672720c4f2a21: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*Original source description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.
URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.
This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-109821View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 0.5.0
Before: 1.18.6
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.19.0-rc.0
Before: 1.19.7
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.20.0-rc.0
Before: 1.20.5
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.6",
"versionStartIncluding": "0.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.7",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.5",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-109821
Observed 2026-10-30T18:16:09.867Z · upstream updated 2026-10-30T16:52:43.052Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T16:52:15.736711Z", "decisions": [ { "name": "Exploitation", "value": "poc" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.