CVE-2026-115274
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length.
Risk Assessment
A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
Recommendation
Upgrade Elixir to version 1.18.6, 1.19.7, or 1.20.5 (or later) depending on the branch in use. Until deployed, consider limiting request body sizes at the proxy level.
Other vulnerabilities in Elixir
See all- CVE-2026-109821Medium
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 without bounding its length.
- CVE-2026-75758Medium
Uncontrolled recursion in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. The issue stems from misclassification of a list as a charlist, leading to recursive exception raising and stack growth until memory exhaustion.
- CVE-2026-49762Medium
The Version module in the Elixir standard library (versions from 0.9.3 before 1.20.1) is vulnerable to uncontrolled resource consumption. An attacker controlling a version string can cause a denial of service through CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, leading to super-linear conversion and process crashes.
Original NVD description (English source)
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS