Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by EEF

CVE-2026-115274Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Medium 6.9

In plain English

A medium-severity security flaw in elixir from elixir-lang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13elixir-langno fix listedDEBIAN-CVE-2026-115274
Debian:14elixir-langno fix listedDEBIAN-CVE-2026-115274

Affected products (as reported)

VendorProductVersions
elixir-lang elixir 1.18.0-rc.0 – before 1.18.61.19.0-rc.0 – before 1.19.71.20.0-rc.0 – before 1.20.5
elixir-lang elixir 793c1147210388587defb649f25f293ffbfa6b1b – before *

Weakness: CWE-1284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References