CVE-2026-109821 Details

A denial-of-service vulnerability has been identified in the Elixir standard library's URI module. This issue arises from improper validation of the port component in URLs parsed by URI.parse/1. An attacker can supply a URL with an excessively long port, causing the application to exhaust CPU resources. The vulnerability is present in Elixir versions 0.5.0 prior to 1.18.6, as well as in the 1.19.0-rc.0 prior to 1.19.7 and 1.20.0-rc.0 prior to 1.20.5 releases. The problem stems from the fact that URI.parse/1 converts the port using String.to_integer/1 without limiting its length. This allows ports of up to 1,262,592 decimal digits to be processed, creating a bignum of that size. While longer inputs trigger a SystemLimitError, the real issue occurs when the parsed URI is converted back to a string, which involves a quadratic-time operation on certain Erlang/OTP versions, including 27, 28, and 29.0. As a result, a port with 400,000 digits takes approximately 2.6 seconds to render, while one megabyte in size requires about 18 seconds.

Elixir versions 1.18.6, 1.19.7, and 1.20.5 have addressed this vulnerability by implementing proper port validation. Users can upgrade to these versions to mitigate the issue.