AZL-111661: CVE-2026-109821 affecting package elixir 1.16.1-3

Q: What inputs and application behavior are required for exploitation?

An attacker must be able to supply a URL whose authority contains an extremely long decimal port component. The CPU exhaustion occurs when the resulting parsed URI is rendered back to text, such as through URI.to_string/1, inspect/1, logging, or error formatting.

Q: Which runtime versions make the rendering cost especially significant?

The described quadratic integer-to-text conversion occurs on Erlang/OTP 27, 28, and 29.0. A 400,000-digit port is reported to take about 2.6 seconds to render, while a 1 MB port takes about 18 seconds.

Q: Are only valid network port values affected?

No. URI.parse/1 accepts ports above 65535, and it does not bound the length before converting the decimal port string to an integer. Ports up to 1,262,592 decimal digits can create a bignum; longer values raise SystemLimitError.

Q: Which Elixir releases contain the fix?

The issue is fixed in Elixir 1.18.6, 1.19.7, and 1.20.5. Affected ranges are 0.5.0 through versions before 1.18.6, 1.19.0-rc.0 through versions before 1.19.7, and 1.20.0-rc.0 through versions before 1.20.5.

Published Oct 30, 2026

Updated

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.

URI.parse/1 converts the port component with String.tointeger/1 in splitauthority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.tostring/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integertobinary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.

This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Affected Software

1 affected component

azure-linux/elixir<=1.16.1-3

Event History

Oct 30, 2026

Advisory Published

via OSV·09:17 AM

Data Sourced

via OSV·09:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-109821

Frequently Asked Questions

What inputs and application behavior are required for exploitation?

An attacker must be able to supply a URL whose authority contains an extremely long decimal port component. The CPU exhaustion occurs when the resulting parsed URI is rendered back to text, such as through URI.to_string/1, inspect/1, logging, or error formatting.

Which runtime versions make the rendering cost especially significant?

The described quadratic integer-to-text conversion occurs on Erlang/OTP 27, 28, and 29.0. A 400,000-digit port is reported to take about 2.6 seconds to render, while a 1 MB port takes about 18 seconds.

Are only valid network port values affected?

No. URI.parse/1 accepts ports above 65535, and it does not bound the length before converting the decimal port string to an integer. Ports up to 1,262,592 decimal digits can create a bignum; longer values raise SystemLimitError.

Which Elixir releases contain the fix?

The issue is fixed in Elixir 1.18.6, 1.19.7, and 1.20.5. Affected ranges are 0.5.0 through versions before 1.18.6, 1.19.0-rc.0 through versions before 1.19.7, and 1.20.0-rc.0 through versions before 1.20.5.

AZL-111661: CVE-2026-109821 affecting package elixir 1.16.1-3

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What inputs and application behavior are required for exploitation?

Which runtime versions make the rendering cost especially significant?

Are only valid network port values affected?

Which Elixir releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What inputs and application behavior are required for exploitation?

Which runtime versions make the rendering cost especially significant?

Are only valid network port values affected?

Which Elixir releases contain the fix?