CVE-2026-59696: uri_string does not bound the port component of a URI before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.
uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uristring:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.
This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 29.0.6 - Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 6.2.2.5 - Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 7.3.0.2 - Upgrade
Upgrade
Erlang/OTP stdlib (uri_string)to a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
Which applications are exposed in practice?
Any application that parses attacker-supplied URIs through uri_string:parse/1 is exposed, because the affected conversion is reached through every authority-parsing path, including host, registered-name, IPv4, and IPv6 forms. No additional configuration is required.
What does an attacker need to supply to trigger the issue?
An attacker needs to provide a syntactically valid URI containing a port component made of a very long sequence of digits. The port substring is converted as an arbitrary-size integer, consuming hundreds of milliseconds in the calling process for ports of roughly 1.26 million digits.
Which releases contain the fix?
Fixed releases are OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6. The corresponding fixed stdlib releases are 6.2.2.5, 7.3.0.2, and 8.0.4.
What can be done if upgrading is not immediately possible?
Callers must bound the length of a URI port component before parsing or otherwise reject attacker-controlled URIs with excessively long numeric ports. The underlying integer conversion accepts integers of any size, so input length validation is necessary.