جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted. This issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

• https://cna.erlef.org/cves/CVE-2026-109821.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-109821 related
• https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2 related
• https://github.com/elixir-lang/elixir/commit/39801821eef2d06524e5ebf5a0e4b3c380ad23ae related
• https://github.com/elixir-lang/elixir/commit/9a39d64a4473d02681c486bc70681c972479d32b patch
• https://github.com/elixir-lang/elixir/commit/b70f33a591b6ab8eb0fa4a7e00bac1c2ed4e0d58 patch
• https://github.com/elixir-lang/elixir/commit/07d9abc3f3ac4c8d2ba8384bd102b6d6205b08b7 patch
• https://github.com/elixir-lang/elixir/commit/d879b39d778fec2f475689573d5672720c4f2a21 patch
• https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg vendor-advisoryrelated