CVE-2026-115274 Details

A denial-of-service vulnerability has been identified in the JSON module of the Elixir standard library. This issue arises from improper validation of integer literals in JSON documents, allowing an unauthenticated attacker to cause CPU and memory exhaustion. The vulnerability is present in Elixir versions 1.18.0-rc.0 prior to 1.18.6, 1.19.0-rc.0 prior to 1.19.7, and 1.20.0-rc.0 prior to 1.20.5. The problem occurs because the JSON.decode/1 and JSON.decode!/1 functions convert integer literals using erlang:binary_to_integer/1 without limiting their length. While a one-million-digit literal can be decoded, it consumes 100 to 300 times more CPU than a string of the same length. Consequently, a request body of just a few megabytes can tie up a scheduler for about a second. Literals exceeding approximately 1.29 million digits trigger a SystemLimitError. This vulnerability affects applications created with 'phx.new', as they decode JSON in Plug.Parsers before routing and authentication, leaving them open to this type of attack.

Users can upgrade to Elixir versions 1.18.6, 1.19.7, or 1.20.5 to address this vulnerability. In addition, for applications using the Phoenix framework, it is recommended to pass a custom JSON decoder that rejects long integer literals before conversion.