{"id":"CVE-2026-109821","title":"Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir","summary":"Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\nURI.parse/1 converts the port compon…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-1284","CWE-400"],"vendor":"elixir-lang","product":"elixir","affected":["elixir >= 0.5.0 < 1.18.6","elixir >= 1.19.0-rc.0 < 1.19.7","elixir >= 1.20.0-rc.0 < 1.20.5","elixir-lang/elixir >= 39801821eef2d06524e5ebf5a0e4b3c380ad23ae < *"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:52:15.736711Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:52:43.052Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109821","references":[{"url":"https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg","label":"Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service"},{"url":"https://cna.erlef.org/cves/CVE-2026-109821.html","label":"EEF CNA record for CVE-2026-109821"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-109821","label":"OSV record EEF-CVE-2026-109821"},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2","label":"Erlang/OTP advisory for the same issue in uri_string"},{"url":"https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae","label":"Introducing commit 3980182 in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b","label":"Fix commit 9a39d64 in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58","label":"Fix commit b70f33a in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7","label":"Fix commit 07d9abc in elixir-lang/elixir"},{"url":"https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21","label":"Fix commit d879b39 in elixir-lang/elixir"}],"tags":["cve.org","exploit-available"],"epss":0.00496,"epssPercentile":0.42806,"ingestedAt":"2026-11-05T16:24:31.099Z","slug":"CVE-2026-109821","body":"## Overview\n\nImproper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\nURI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\n\nThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.\n\n## Affected\n\n- `elixir >= 0.5.0 < 1.18.6`\n- `elixir >= 1.19.0-rc.0 < 1.19.7`\n- `elixir >= 1.20.0-rc.0 < 1.20.5`\n- `elixir-lang/elixir >= 39801821eef2d06524e5ebf5a0e4b3c380ad23ae < *`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nReject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed port above 65535 before rendering or using the %URI{}. URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where :uri_string limits the port to 5 digits.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}