Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
Impact
Elixir's JSON module has an unbounded integer parsing vulnerability, allowing an unauthenticated attacker to cause a denial of service through CPU and memory exhaustion in versions 1.18.0-rc.0 before 1.18.6, 1.19.0-rc.0 before 1.19.7, and 1.20.0-rc.0 before 1.20.5. The issue arises from improper validation of specified quantity in input.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Decode untrusted JSON with an integer decoder that rejects long digit runs before conversion:
defmodule SafeJSON do def decode!(binary) do case JSON.decode(binary, :ok, integer: &safe_integer/1) do {decoded, :ok, ""} -> decoded _ -> raise ArgumentError, "invalid JSON" end end
defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits) defp safe_integer(_digits), do: raise(ArgumentError, "integer too long") end
In Phoenix, pass SafeJSON to Plug.Parsers as json_decoder instead of Phoenix.json_library().
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
elixir-lang · EEF
elixir
3 ranges
elixir-lang · EEF
elixir
Package identity
pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.gitIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.18.0-rc.0 → before 1.18.6
semver versions
1.19.0-rc.0 → before 1.19.7
semver versions
1.20.0-rc.0 → before 1.20.5
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*elixir-lang · EEF
elixir
1 range
elixir-lang · EEF
elixir
Package identity
pkg:github/elixir-lang/elixirIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
793c1147210388587defb649f25f293ffbfa6b1b → before *
git versions
From c81f12265919c34a0d5134f1905a4eb4edaea1c2: unaffected
From 7154e8781da9fd016a973ea01776a011c8b5726a: unaffected
From cd158efacdc10b30232864251747dff9b8387dfe: unaffected
From ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*Original source description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115274View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.18.0-rc.0
Before: 1.18.6
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.19.0-rc.0
Before: 1.19.7
Vulnerable product
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*From (inclusive): 1.20.0-rc.0
Before: 1.20.5
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.6",
"versionStartIncluding": "1.18.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.7",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.5",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-115274
Observed 2026-10-30T18:16:11.615Z · upstream updated 2026-10-30T16:51:45.396Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T16:51:17.679403Z", "decisions": [ { "name": "Exploitation", "value": "poc" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.