Elixir vulnerabilities

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length.

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 without bounding its length.

Uncontrolled recursion in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. The issue stems from misclassification of a list as a charlist, leading to recursive exception raising and stack growth until memory exhaustion.

The Version module in the Elixir standard library (versions from 0.9.3 before 1.20.1) is vulnerable to uncontrolled resource consumption. An attacker controlling a version string can cause a denial of service through CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, leading to super-linear conversion and process crashes.