Search
Find a vulnerability
Search criteria
4 vulnerabilities found for elixir by elixir-lang
CVE-2026-75758 (GCVE-0-2026-75758)
Vulnerability from nvd – Published: 2026-08-28 11:28 – Updated: 2026-08-28 18:29
VLAI
EPSS
VEX
Title
Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
Summary
Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory.
Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.
Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.
This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:28 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
1.15.0-rc.0 , < 1.18.5
(semver)
Affected: 1.19.0-rc.0 , < 1.19.6 (semver) Affected: 1.20.0-rc.0 , < 1.20.4 (semver) cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
9718f2b90ce086ff8614d5782f4ec528495c98dd , < *
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:28:19.564474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:29:23.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/inspect.ex",
"lib/list.ex",
"lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.18.5",
"status": "affected",
"version": "1.15.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.19.6",
"status": "affected",
"version": "1.19.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.20.4",
"status": "affected",
"version": "1.20.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/inspect.ex",
"lib/elixir/lib/list.ex",
"lib/elixir/lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"changes": [
{
"at": "1eff1acffd49bdcc0d7f57ca74c1603328eed68a",
"status": "unaffected"
},
{
"at": "5230d73968f1b4969d2a2646786fa6c71475f5cc",
"status": "unaffected"
},
{
"at": "a983c8c043b1fbf1d95df78a29149222dac2988c",
"status": "unaffected"
},
{
"at": "0bba5887577b1e328da825bd018815fdc519685a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "9718f2b90ce086ff8614d5782f4ec528495c98dd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.5",
"versionStartIncluding": "1.15.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.6",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.4",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Cioppettini / Scalpel Software Inc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to \u003ccode\u003einspect/1\u003c/code\u003e, \u003ccode\u003eList.to_string/1\u003c/code\u003e, or \u003ccode\u003eList.to_charlist/1\u003c/code\u003e to exhaust a BEAM node\u0027s memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eInspect.List\u003c/code\u003e\u0027s charlist branch in \u003ccode\u003elib/elixir/lib/inspect.ex\u003c/code\u003e classifies a list as a charlist using \u003ccode\u003eList.ascii_printable?/2\u003c/code\u003e, which examines only the first \u003ccode\u003e:printable_limit\u003c/code\u003e (4096 by default) elements, and then calls \u003ccode\u003eIO.chardata_to_string/1\u003c/code\u003e on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises \u003ccode\u003eArgumentError\u003c/code\u003e. That conversion runs inside \u003ccode\u003eList.to_string/1\u003c/code\u003e, whose rescue clause builds its message by interpolating \u003ccode\u003einspect(list)\u003c/code\u003e, which re-enters the same branch and raises again. The nested inspection is an argument to \u003ccode\u003eraise\u003c/code\u003e, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by \u003ccode\u003emax_heap_size\u003c/code\u003e or, by default, the node runs out of memory. \u003ccode\u003eList.to_charlist/1\u003c/code\u003e has the same rescue shape.\u003c/p\u003e\n\u003cp\u003eBelow the printable limit the inner \u003ccode\u003einspect/1\u003c/code\u003e sees the invalid element within its counter and renders the list in ordinary bracket form, so a single \u003ccode\u003eArgumentError\u003c/code\u003e is raised and no recursion occurs.\u003c/p\u003e\n\u003cp\u003eThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to `inspect/1`, `List.to_string/1`, or `List.to_charlist/1` to exhaust a BEAM node\u0027s memory.\n\n`Inspect.List`\u0027s charlist branch in `lib/elixir/lib/inspect.ex` classifies a list as a charlist using `List.ascii_printable?/2`, which examines only the first `:printable_limit` (4096 by default) elements, and then calls `IO.chardata_to_string/1` on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises `ArgumentError`. That conversion runs inside `List.to_string/1`, whose rescue clause builds its message by interpolating `inspect(list)`, which re-enters the same branch and raises again. The nested inspection is an argument to `raise`, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by `max_heap_size` or, by default, the node runs out of memory. `List.to_charlist/1` has the same rescue shape.\n\nBelow the printable limit the inner `inspect/1` sees the invalid element within its counter and renders the list in ordinary bracket form, so a single `ArgumentError` is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node\u0027s memory.\n\nInspect.List\u0027s charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.\n\nBelow the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:28:53.505Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/1eff1acffd49bdcc0d7f57ca74c1603328eed68a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/5230d73968f1b4969d2a2646786fa6c71475f5cc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/a983c8c043b1fbf1d95df78a29149222dac2988c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/0bba5887577b1e328da825bd018815fdc519685a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInstall a global inspect function that renders lists as lists rather than inferring charlists, by calling \u003ccode\u003eInspect.Opts.default_inspect_fun/1\u003c/code\u003e with \u003ccode\u003efn term, opts -\u0026gt; Inspect.inspect(term, %{opts | charlists: :as_lists}) end\u003c/code\u003e from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\u003c/p\u003e\n\u003cp\u003eThe trade-off is global: charlists then render in bracket form, so \u003ccode\u003e~c\"abc\"\u003c/code\u003e inspects as \u003ccode\u003e[97, 98, 99]\u003c/code\u003e everywhere in the application, including in logs and error reports.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling `Inspect.Opts.default_inspect_fun/1` with `fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end` from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so `~c\"abc\"` inspects as `[97, 98, 99]` everywhere in the application, including in logs and error reports."
}
],
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling Inspect.Opts.default_inspect_fun/1 with fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so ~c\"abc\" inspects as [97, 98, 99] everywhere in the application, including in logs and error reports."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75758",
"datePublished": "2026-08-28T11:28:53.505Z",
"dateReserved": "2026-08-19T09:00:01.955Z",
"dateUpdated": "2026-08-28T18:29:23.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49762 (GCVE-0-2026-49762)
Vulnerability from nvd – Published: 2026-06-09 14:04 – Updated: 2026-06-10 04:43
VLAI
EPSS
VEX
Title
Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service
Summary
Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.
The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.
This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.
This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.
This issue affects Elixir: from 1.5.0 before 1.20.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 14:48 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-lang/elixir/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-49762.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-49762 | related |
| https://github.com/elixir-lang/elixir/commit/c644… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
1.5.0 , < 1.20.1
(semver)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
63e186aea94395897dc4964d82d250130c01ec25 , < c64417d72fd5c7d09e963ca3ac5fa2b140978d9e
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T14:48:56.343391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:49:07.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Version\u0027",
"\u0027Elixir.Version.Parser\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/version.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Version\u0027:parse/1"
},
{
"name": "\u0027Elixir.Version\u0027:parse!/1"
},
{
"name": "\u0027Elixir.Version\u0027:match?/3"
},
{
"name": "\u0027Elixir.Version\u0027:compare/2"
},
{
"name": "\u0027Elixir.Version\u0027:parse_requirement/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.20.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Version\u0027",
"\u0027Elixir.Version.Parser\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/version.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Version\u0027:parse/1"
},
{
"name": "\u0027Elixir.Version\u0027:parse!/1"
},
{
"name": "\u0027Elixir.Version\u0027:match?/3"
},
{
"name": "\u0027Elixir.Version\u0027:compare/2"
},
{
"name": "\u0027Elixir.Version\u0027:parse_requirement/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
}
],
"repo": "https://github.com/elixir-lang/elixir.git",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
"status": "affected",
"version": "63e186aea94395897dc4964d82d250130c01ec25",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.1",
"versionStartIncluding": "1.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s \u003ctt\u003eVersion\u003c/tt\u003e module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\u003c/p\u003e\u003cp\u003eThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (\u003ctt\u003eString.to_integer/1\u003c/tt\u003e, i.e. \u003ctt\u003e:erlang.binary_to_integer/1\u003c/tt\u003e) that pins a BEAM scheduler, and a larger component raises an uncaught \u003ctt\u003eSystemLimitError\u003c/tt\u003e that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\u003c/p\u003e\u003cp\u003eThis is reachable from the public entry points \u003ctt\u003eVersion.parse/1\u003c/tt\u003e, \u003ctt\u003eVersion.parse!/1\u003c/tt\u003e, \u003ctt\u003eVersion.match?/3\u003c/tt\u003e, \u003ctt\u003eVersion.compare/2\u003c/tt\u003e, and \u003ctt\u003eVersion.parse_requirement/1\u003c/tt\u003e, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/version.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Version.Parser\u0027:parse_digits/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Elixir: from 1.5.0 before 1.20.1.\u003c/p\u003e"
}
],
"value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T04:43:08.517Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-49762.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-49762",
"datePublished": "2026-06-09T14:04:07.405Z",
"dateReserved": "2026-06-01T13:45:22.449Z",
"dateUpdated": "2026-06-10T04:43:08.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75758 (GCVE-0-2026-75758)
Vulnerability from cvelistv5 – Published: 2026-08-28 11:28 – Updated: 2026-08-28 18:29
VLAI
EPSS
VEX
Title
Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
Summary
Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory.
Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.
Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.
This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:28 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
1.15.0-rc.0 , < 1.18.5
(semver)
Affected: 1.19.0-rc.0 , < 1.19.6 (semver) Affected: 1.20.0-rc.0 , < 1.20.4 (semver) cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
9718f2b90ce086ff8614d5782f4ec528495c98dd , < *
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:28:19.564474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:29:23.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/inspect.ex",
"lib/list.ex",
"lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.18.5",
"status": "affected",
"version": "1.15.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.19.6",
"status": "affected",
"version": "1.19.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.20.4",
"status": "affected",
"version": "1.20.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/inspect.ex",
"lib/elixir/lib/list.ex",
"lib/elixir/lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"changes": [
{
"at": "1eff1acffd49bdcc0d7f57ca74c1603328eed68a",
"status": "unaffected"
},
{
"at": "5230d73968f1b4969d2a2646786fa6c71475f5cc",
"status": "unaffected"
},
{
"at": "a983c8c043b1fbf1d95df78a29149222dac2988c",
"status": "unaffected"
},
{
"at": "0bba5887577b1e328da825bd018815fdc519685a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "9718f2b90ce086ff8614d5782f4ec528495c98dd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.5",
"versionStartIncluding": "1.15.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.6",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.4",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Cioppettini / Scalpel Software Inc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to \u003ccode\u003einspect/1\u003c/code\u003e, \u003ccode\u003eList.to_string/1\u003c/code\u003e, or \u003ccode\u003eList.to_charlist/1\u003c/code\u003e to exhaust a BEAM node\u0027s memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eInspect.List\u003c/code\u003e\u0027s charlist branch in \u003ccode\u003elib/elixir/lib/inspect.ex\u003c/code\u003e classifies a list as a charlist using \u003ccode\u003eList.ascii_printable?/2\u003c/code\u003e, which examines only the first \u003ccode\u003e:printable_limit\u003c/code\u003e (4096 by default) elements, and then calls \u003ccode\u003eIO.chardata_to_string/1\u003c/code\u003e on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises \u003ccode\u003eArgumentError\u003c/code\u003e. That conversion runs inside \u003ccode\u003eList.to_string/1\u003c/code\u003e, whose rescue clause builds its message by interpolating \u003ccode\u003einspect(list)\u003c/code\u003e, which re-enters the same branch and raises again. The nested inspection is an argument to \u003ccode\u003eraise\u003c/code\u003e, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by \u003ccode\u003emax_heap_size\u003c/code\u003e or, by default, the node runs out of memory. \u003ccode\u003eList.to_charlist/1\u003c/code\u003e has the same rescue shape.\u003c/p\u003e\n\u003cp\u003eBelow the printable limit the inner \u003ccode\u003einspect/1\u003c/code\u003e sees the invalid element within its counter and renders the list in ordinary bracket form, so a single \u003ccode\u003eArgumentError\u003c/code\u003e is raised and no recursion occurs.\u003c/p\u003e\n\u003cp\u003eThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to `inspect/1`, `List.to_string/1`, or `List.to_charlist/1` to exhaust a BEAM node\u0027s memory.\n\n`Inspect.List`\u0027s charlist branch in `lib/elixir/lib/inspect.ex` classifies a list as a charlist using `List.ascii_printable?/2`, which examines only the first `:printable_limit` (4096 by default) elements, and then calls `IO.chardata_to_string/1` on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises `ArgumentError`. That conversion runs inside `List.to_string/1`, whose rescue clause builds its message by interpolating `inspect(list)`, which re-enters the same branch and raises again. The nested inspection is an argument to `raise`, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by `max_heap_size` or, by default, the node runs out of memory. `List.to_charlist/1` has the same rescue shape.\n\nBelow the printable limit the inner `inspect/1` sees the invalid element within its counter and renders the list in ordinary bracket form, so a single `ArgumentError` is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node\u0027s memory.\n\nInspect.List\u0027s charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.\n\nBelow the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:28:53.505Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/1eff1acffd49bdcc0d7f57ca74c1603328eed68a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/5230d73968f1b4969d2a2646786fa6c71475f5cc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/a983c8c043b1fbf1d95df78a29149222dac2988c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/0bba5887577b1e328da825bd018815fdc519685a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInstall a global inspect function that renders lists as lists rather than inferring charlists, by calling \u003ccode\u003eInspect.Opts.default_inspect_fun/1\u003c/code\u003e with \u003ccode\u003efn term, opts -\u0026gt; Inspect.inspect(term, %{opts | charlists: :as_lists}) end\u003c/code\u003e from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\u003c/p\u003e\n\u003cp\u003eThe trade-off is global: charlists then render in bracket form, so \u003ccode\u003e~c\"abc\"\u003c/code\u003e inspects as \u003ccode\u003e[97, 98, 99]\u003c/code\u003e everywhere in the application, including in logs and error reports.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling `Inspect.Opts.default_inspect_fun/1` with `fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end` from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so `~c\"abc\"` inspects as `[97, 98, 99]` everywhere in the application, including in logs and error reports."
}
],
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling Inspect.Opts.default_inspect_fun/1 with fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so ~c\"abc\" inspects as [97, 98, 99] everywhere in the application, including in logs and error reports."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75758",
"datePublished": "2026-08-28T11:28:53.505Z",
"dateReserved": "2026-08-19T09:00:01.955Z",
"dateUpdated": "2026-08-28T18:29:23.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49762 (GCVE-0-2026-49762)
Vulnerability from cvelistv5 – Published: 2026-06-09 14:04 – Updated: 2026-06-10 04:43
VLAI
EPSS
VEX
Title
Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service
Summary
Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.
The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.
This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.
This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.
This issue affects Elixir: from 1.5.0 before 1.20.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 14:48 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-lang/elixir/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-49762.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-49762 | related |
| https://github.com/elixir-lang/elixir/commit/c644… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
1.5.0 , < 1.20.1
(semver)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
63e186aea94395897dc4964d82d250130c01ec25 , < c64417d72fd5c7d09e963ca3ac5fa2b140978d9e
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T14:48:56.343391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:49:07.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Version\u0027",
"\u0027Elixir.Version.Parser\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/version.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Version\u0027:parse/1"
},
{
"name": "\u0027Elixir.Version\u0027:parse!/1"
},
{
"name": "\u0027Elixir.Version\u0027:match?/3"
},
{
"name": "\u0027Elixir.Version\u0027:compare/2"
},
{
"name": "\u0027Elixir.Version\u0027:parse_requirement/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.20.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Version\u0027",
"\u0027Elixir.Version.Parser\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/version.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Version\u0027:parse/1"
},
{
"name": "\u0027Elixir.Version\u0027:parse!/1"
},
{
"name": "\u0027Elixir.Version\u0027:match?/3"
},
{
"name": "\u0027Elixir.Version\u0027:compare/2"
},
{
"name": "\u0027Elixir.Version\u0027:parse_requirement/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
},
{
"name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
}
],
"repo": "https://github.com/elixir-lang/elixir.git",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
"status": "affected",
"version": "63e186aea94395897dc4964d82d250130c01ec25",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.1",
"versionStartIncluding": "1.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s \u003ctt\u003eVersion\u003c/tt\u003e module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\u003c/p\u003e\u003cp\u003eThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (\u003ctt\u003eString.to_integer/1\u003c/tt\u003e, i.e. \u003ctt\u003e:erlang.binary_to_integer/1\u003c/tt\u003e) that pins a BEAM scheduler, and a larger component raises an uncaught \u003ctt\u003eSystemLimitError\u003c/tt\u003e that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\u003c/p\u003e\u003cp\u003eThis is reachable from the public entry points \u003ctt\u003eVersion.parse/1\u003c/tt\u003e, \u003ctt\u003eVersion.parse!/1\u003c/tt\u003e, \u003ctt\u003eVersion.match?/3\u003c/tt\u003e, \u003ctt\u003eVersion.compare/2\u003c/tt\u003e, and \u003ctt\u003eVersion.parse_requirement/1\u003c/tt\u003e, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/version.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Version.Parser\u0027:parse_digits/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Elixir: from 1.5.0 before 1.20.1.\u003c/p\u003e"
}
],
"value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T04:43:08.517Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-49762.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-49762",
"datePublished": "2026-06-09T14:04:07.405Z",
"dateReserved": "2026-06-01T13:45:22.449Z",
"dateUpdated": "2026-06-10T04:43:08.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}