Hi,
The following vulnerabilities were published for elixir-lang.
CVE-2026-109821[0]:
| Improper Validation of Specified Quantity in Input vulnerability in
| the Elixir standard library's URI module allows an attacker who
| supplies a URL to cause a denial of service through CPU exhaustion.
| URI.parse/1 converts the port component with String.to_integer/1 in
| split_authority/1 (lib/elixir/lib/uri.ex) without bounding its
| length, so a port of up to 1,262,592 decimal digits produces a
| bignum of that size and a longer one raises SystemLimitError.
| Rendering the parsed URI back to text (URI.to_string/1, inspect/1,
| logging, error formatting) converts the bignum with
| :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28
| and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1
| MB port in about 18 seconds. Ports above 65535 are also accepted.
| This issue affects elixir: from 0.5.0 before 1.18.6, from
| 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg
https://cna.erlef.org/cves/CVE-2026-109821.html
https://osv.dev/vulnerability/EEF-CVE-2026-109821
Introduced by: https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae
Fixed by: https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21 (main)
Fixed by: https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b (v1.20.5)
Fixed by: https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7 (v1.18.6)
CVE-2026-115274[1]:
| Improper Validation of Specified Quantity in Input vulnerability in
| the Elixir standard library's JSON module allows an unauthenticated
| attacker who supplies a JSON document to cause a denial of service
| through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1
| convert each integer literal with erlang:binary_to_integer/1 and do
| not bound its length. A literal of one million digits decodes
| successfully but costs 100 to 300 times as much CPU as a string of
| the same length, so one request body of a few megabytes holds a
| scheduler for about a second. A literal of more than about 1.29
| million digits raises SystemLimitError. Applications generated by
| phx.new decode request bodies with JSON in Plug.Parsers, before
| routing and authentication. This issue affects elixir: from
| 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from
| 1.20.0-rc.0 before 1.20.5.
https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h
https://cna.erlef.org/cves/CVE-2026-115274.html
https://osv.dev/vulnerability/EEF-CVE-2026-115274
Introduced by: https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b (v1.18.0-rc.0)
Fixed by: https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396 (main)
Fixed by: https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2 (v1.20.5)
Fixed by: https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe (v1.18.6)
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-109821
https://www.cve.org/CVERecord?id=CVE-2026-109821
[1] https://security-tracker.debian.org/tracker/CVE-2026-115274
https://www.cve.org/CVERecord?id=CVE-2026-115274
Please adjust the affected versions in the BTS as needed.