{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-49762", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-01T13:45:22.449Z", "datePublished": "2026-06-09T14:04:07.405Z", "dateUpdated": "2026-10-06T08:35:59.691Z" }, "containers": { "cna": { "affected": [ { "cpes": [ "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.Version'", "'Elixir.Version.Parser'" ], "packageName": "elixir", "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git", "product": "elixir", "programFiles": [ "lib/version.ex" ], "programRoutines": [ { "name": "'Elixir.Version':parse/1" }, { "name": "'Elixir.Version':parse!/1" }, { "name": "'Elixir.Version':match?/3" }, { "name": "'Elixir.Version':compare/2" }, { "name": "'Elixir.Version':parse_requirement/1" }, { "name": "'Elixir.Version.Parser':parse_version/2" }, { "name": "'Elixir.Version.Parser':parse_digits/2" }, { "name": "'Elixir.Version.Parser':require_digits/1" }, { "name": "'Elixir.Version.Parser':convert_parts_to_integer/2" } ], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [ { "lessThan": "1.20.1", "status": "affected", "version": "0.9.3", "versionType": "semver" } ] }, { "collectionURL": "https://github.com", "cpes": [ "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.Version'", "'Elixir.Version.Parser'" ], "packageName": "elixir-lang/elixir", "packageURL": "pkg:github/elixir-lang/elixir", "product": "elixir", "programFiles": [ "lib/elixir/lib/version.ex" ], "programRoutines": [ { "name": "'Elixir.Version':parse/1" }, { "name": "'Elixir.Version':parse!/1" }, { "name": "'Elixir.Version':match?/3" }, { "name": "'Elixir.Version':compare/2" }, { "name": "'Elixir.Version':parse_requirement/1" }, { "name": "'Elixir.Version.Parser':parse_version/2" }, { "name": "'Elixir.Version.Parser':parse_digits/2" }, { "name": "'Elixir.Version.Parser':require_digits/1" }, { "name": "'Elixir.Version.Parser':convert_parts_to_integer/2" } ], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [ { "changes": [ { "at": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e", "status": "unaffected" }, { "at": "64e6707233464c3e55a9ca6b44019aed25b0390a", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "057691722eb8cfe315f5606358954a2b173ff7a3", "versionType": "git" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.20.1", "versionStartIncluding": "0.9.3", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "credits": [ { "lang": "en", "type": "finder", "value": "Peter Ullrich" }, { "lang": "en", "type": "remediation developer", "value": "José Valim" }, { "lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-Jönsson" }, { "lang": "en", "type": "analyst", "value": "Jonatan Männchen / EEF" } ], "datePublic": "2026-06-09T14:04:07.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.

\n

The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.

\n

This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.

\n

This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.

\n

This issue affects elixir: from 0.9.3 before 1.20.1.

" }, { "base64": false, "type": "text/markdown", "value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library's `Version` module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (`String.to_integer/1`, i.e. `:erlang.binary_to_integer/1`) that pins a BEAM scheduler, and a larger component raises an uncaught `SystemLimitError` that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points `Version.parse/1`, `Version.parse!/1`, `Version.match?/3`, `Version.compare/2`, and `Version.parse_requirement/1`, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files `lib/version.ex` and program routines `'Elixir.Version.Parser':parse_digits/2`.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1." } ], "value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1." } ], "impacts": [ { "capecId": "CAPEC-130", "descriptions": [ { "lang": "en", "value": "CAPEC-130 Excessive Allocation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-06T08:35:59.691Z" }, "references": [ { "name": "GitHub Advisory", "tags": [ "related", "vendor-advisory" ], "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p" }, { "name": "EEF CNA record for CVE-2026-49762", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-49762.html" }, { "name": "OSV record EEF-CVE-2026-49762", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762" }, { "name": "Introducing commit 0576917 in elixir-lang/elixir", "tags": [ "related" ], "url": "https://github.com/elixir-lang/elixir/commit/057691722eb8cfe315f5606358954a2b173ff7a3" }, { "name": "Fix commit c64417d in elixir-lang/elixir", "tags": [ "patch" ], "url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e" }, { "name": "Fix commit 64e6707 in elixir-lang/elixir", "tags": [ "patch" ], "url": "https://github.com/elixir-lang/elixir/commit/64e6707233464c3e55a9ca6b44019aed25b0390a" } ], "source": { "discovery": "EXTERNAL" }, "title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service" }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-06-09T14:48:56.343391Z", "id": "CVE-2026-49762", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:49:07.338Z" } } ] } }