The vulnerability arises from the Elixir standard library’s URI module failing to bound the length of a URL’s port component. When a URL with a port of over a million digits is parsed, the library creates an enormous bignum and later attempts to render it back to a string. Rendering such a bignum requires quadratic memory and CPU, causing noticeable delays and eventual exhaustion of resources. As a result, an attacker can trigger a denial‑of‑service attack at the process or system level by supplying a specially crafted URL.

Elixir releases from 0.5.0 up to before 1.18.6, from 1.19.0‑rc.0 up to before 1.19.7, and from 1.20.0‑rc.0 up to before 1.20.5 are vulnerable. The issue is also present in all Erlang/OTP releases prior to 27.3.4.17, 28.5.0.6, and 29.0.6; upgrading to those or later versions mitigates the problem because the underlying :uri_string module now limits the port length to five digits. Reducing the maximum allowed port number to 65 535 also blocks invalid values.

The CVSS base score of 6.3 indicates a moderate impact, and the EPSS score is not available, so the likelihood of active exploitation remains uncertain. Nonetheless, the error handling paths that re‑render parsed URIs—such as logging, error messages, or debugging output—constitute the exploitation vector, so any component that receives arbitrary user input and may trigger these paths is at risk. The vulnerability is not currently catalogued in CISA's KEV list, and no active exploit has been reported. Mitigations include upgrading the Elixir runtime or Erlang/OTP to patched releases, or applying the proposed workaround of rejecting excessively long URLs or ports over 65 535 before parsing them.