{"id":"CVE-2026-115274","aliases":[],"cve":{"records":[{"id":"CVE-2026-115274","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T12:45:01.103Z","published":"2026-10-30T08:57:16.847Z","modified":"2026-10-30T16:51:45.396Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-30T09:01:54.926Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:51:45.396Z"}],"references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-115274.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-115274","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b","tags":["related"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396","tags":["patch"],"source":"EEF"},{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-1284","description":"CWE-1284 Improper Validation of Specified Quantity in Input","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.6","versionStartIncluding":"1.18.0-rc.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.19.7","versionStartIncluding":"1.19.0-rc.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.5","versionStartIncluding":"1.20.0-rc.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:51:17.679403Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir","titleSource":"EEF","descriptionSource":"EEF","description":"Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.","score":6.9,"severity":"medium","published":"2026-10-30T08:57:16.847Z","modified":"2026-10-30T16:51:45.396Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"1.18.0-rc.0","status":"affected","lessThan":"1.18.6","versionType":"semver"},{"version":"1.19.0-rc.0","status":"affected","lessThan":"1.19.7","versionType":"semver"},{"version":"1.20.0-rc.0","status":"affected","lessThan":"1.20.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-115274"},{"vendor":"elixir-lang","name":"elixir","platforms":[],"versions":[{"version":"793c1147210388587defb649f25f293ffbfa6b1b","status":"affected","lessThan":"*","versionType":"git","changes":[{"at":"c81f12265919c34a0d5134f1905a4eb4edaea1c2","status":"unaffected"},{"at":"7154e8781da9fd016a973ea01776a011c8b5726a","status":"unaffected"},{"at":"cd158efacdc10b30232864251747dff9b8387dfe","status":"unaffected"},{"at":"ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396","status":"unaffected"}]}],"defaultStatus":"unaffected","packageURL":"pkg:github/elixir-lang/elixir","cpes":["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-115274"}],"remediation":[{"text":"Decode untrusted JSON with an integer decoder that rejects long digit runs before conversion:\n\ndefmodule SafeJSON do\n  def decode!(binary) do\n    case JSON.decode(binary, :ok, integer: &safe_integer/1) do\n      {decoded, :ok, \"\"} -> decoded\n      _ -> raise ArgumentError, \"invalid JSON\"\n    end\n  end\n\n  defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits)\n  defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n\nIn Phoenix, pass SafeJSON to Plug.Parsers as json_decoder instead of Phoenix.json_library().","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-115274"}],"references":["https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h","https://cna.erlef.org/cves/CVE-2026-115274.html","https://osv.dev/vulnerability/EEF-CVE-2026-115274","https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b","https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2","https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a","https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe","https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396"],"sources":[{"name":"CVE","id":"CVE-2026-115274","modified":"2026-10-30T16:51:45.396Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115274"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9}],"sourceAffected":[],"observedAt":"2026-10-30T18:16:11.615Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T07:45:30.596Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T09:05:35.233Z","attemptedAt":"2026-10-30T09:05:35.233Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T09:05:35.233Z","attemptedAt":"2026-10-30T09:05:35.233Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T09:05:31.457Z","attemptedAt":"2026-10-30T09:05:31.457Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T09:05:31.338Z","attemptedAt":"2026-10-30T09:05:31.338Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113758","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113758","modified":"Oct 30, 2026, 8:57:16 AM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T09:05:31.457Z"}],"aiSummary":{"text":"Elixir's JSON module has an unbounded integer parsing vulnerability, allowing an unauthenticated attacker to cause a denial of service through CPU and memory exhaustion in versions 1.18.0-rc.0 before 1.18.6, 1.19.0-rc.0 before 1.19.7, and 1.20.0-rc.0 before 1.20.5. The issue arises from improper validation of specified quantity in input.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:06:19.070Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115274"}]}}