---
id: CVE-2026-109821
title: >-
  Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service
  in Elixir
summary: >-
  Improper Validation of Specified Quantity in Input vulnerability in the Elixir
  standard library's URI module allows an attacker who supplies a URL to cause a
  denial of service through CPU exhaustion.


  URI.parse/1 converts the port compon…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-1284
  - CWE-400
vendor: elixir-lang
product: elixir
affected:
  - elixir >= 0.5.0 < 1.18.6
  - elixir >= 1.19.0-rc.0 < 1.19.7
  - elixir >= 1.20.0-rc.0 < 1.20.5
  - elixir-lang/elixir >= 39801821eef2d06524e5ebf5a0e4b3c380ad23ae < *
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T16:52:15.736711Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T16:52:43.052Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109821'
references:
  - url: >-
      https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg
    label: >-
      Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of
      service
  - url: 'https://cna.erlef.org/cves/CVE-2026-109821.html'
    label: EEF CNA record for CVE-2026-109821
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-109821'
    label: OSV record EEF-CVE-2026-109821
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2'
    label: Erlang/OTP advisory for the same issue in uri_string
  - url: >-
      https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae
    label: Introducing commit 3980182 in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b
    label: Fix commit 9a39d64 in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58
    label: Fix commit b70f33a in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7
    label: Fix commit 07d9abc in elixir-lang/elixir
  - url: >-
      https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21
    label: Fix commit d879b39 in elixir-lang/elixir
tags:
  - cve.org
  - exploit-available
epss: 0.00496
epssPercentile: 0.42806
ingestedAt: '2026-11-05T16:24:31.099Z'
---

## Overview

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.

URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.

This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

## Affected

- `elixir >= 0.5.0 < 1.18.6`
- `elixir >= 1.19.0-rc.0 < 1.19.7`
- `elixir >= 1.20.0-rc.0 < 1.20.5`
- `elixir-lang/elixir >= 39801821eef2d06524e5ebf5a0e4b3c380ad23ae < *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Reject long URLs before parsing them, for example anything above a few kilobytes, and reject a parsed port above 65535 before rendering or using the %URI{}. URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, where :uri_string limits the port to 5 digits.