{"id":"CVE-2026-109821","aliases":[],"cve":{"records":[{"id":"CVE-2026-109821","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T14:00:01.560Z","published":"2026-10-30T08:54:07.752Z","modified":"2026-10-30T16:52:43.052Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-30T09:02:51.828Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:52:43.052Z"}],"references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-109821.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-109821","tags":["related"],"source":"EEF"},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-1284","description":"CWE-1284 Improper Validation of Specified Quantity in Input","source":"EEF"},{"id":"CWE-400","description":"CWE-400 Uncontrolled Resource Consumption","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.6","versionStartIncluding":"0.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.19.7","versionStartIncluding":"1.19.0-rc.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.5","versionStartIncluding":"1.20.0-rc.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:52:15.736711Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir","titleSource":"EEF","descriptionSource":"EEF","description":"Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\nURI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\n\nThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.","score":6.3,"severity":"medium","published":"2026-10-30T08:54:07.752Z","modified":"2026-10-30T16:52:43.052Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"0.5.0","status":"affected","lessThan":"1.18.6","versionType":"semver"},{"version":"1.19.0-rc.0","status":"affected","lessThan":"1.19.7","versionType":"semver"},{"version":"1.20.0-rc.0","status":"affected","lessThan":"1.20.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109821"},{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"39801821eef2d06524e5ebf5a0e4b3c380ad23ae","status":"affected","lessThan":"*","versionType":"git","changes":[{"at":"9a39d64a4473d02681c486bc70681c972479d32b","status":"unaffected"},{"at":"b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58","status":"unaffected"},{"at":"07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7","status":"unaffected"},{"at":"d879b39d778fec2f475689573d5672720c4f2a21","status":"unaffected"}]}],"defaultStatus":"unaffected","packageURL":"pkg:github/elixir-lang/elixir","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109821"}],"remediation":[{"text":"Reject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed port above 65535 before rendering or using the %URI{}. URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where :uri_string limits the port to 5 digits.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-109821"}],"references":["https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg","https://cna.erlef.org/cves/CVE-2026-109821.html","https://osv.dev/vulnerability/EEF-CVE-2026-109821","https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2","https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae","https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b","https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58","https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7","https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21"],"sources":[{"name":"CVE","id":"CVE-2026-109821","modified":"2026-10-30T16:52:43.052Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109821"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3}],"sourceAffected":[],"observedAt":"2026-10-30T18:16:09.867Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:00:34.533Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T09:05:39.020Z","attemptedAt":"2026-10-30T09:05:39.020Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T09:05:37.216Z","attemptedAt":"2026-10-30T09:05:37.216Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T09:05:37.297Z","attemptedAt":"2026-10-30T09:05:37.297Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T09:05:35.476Z","attemptedAt":"2026-10-30T09:05:35.476Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113757","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113757","modified":"Oct 30, 2026, 8:54:07 AM","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T09:05:37.297Z"}],"aiSummary":{"text":"Elixir versions 0.5.0 to 1.18.6, 1.19.0-rc.0 to 1.19.7, and 1.20.0-rc.0 to 1.20.5 have an improper validation vulnerability, allowing an attacker to cause CPU exhaustion denial of service by supplying a URL with a large port number. The weakness affects the URI module's port parsing. An attacker must supply a malicious URL to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:06:31.207Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-109821"}]}}