Description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.

JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.

This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Published: 2026-10-30
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via CPU and memory exhaustion caused by unbounded integer parsing
Action: Patch Immediately
AI Analysis

Impact

Elixir's standard library JSON module can parse integer literals of any length without validation. Converting a giant integer consumes 100‑300 times more CPU than a similarly sized string, and a literal longer than about 1.29 million digits triggers a SystemLimitError. An unauthenticated attacker can send such a JSON payload in an HTTP request, exhausting a scheduler process for a full second and potentially disrupting service.

Affected Systems

The vulnerability affects Elixir releases starting from 1.18.0-rc.0 through 1.18.5, 1.19.0-rc.0 through 1.19.6, and 1.20.0-rc.0 through 1.20.4. Any application using Elixir's JSON.decode/1 or JSON.decode!/1, especially web frameworks that automatically parse request bodies, is susceptible.

Risk and Exploitability

With a CVSS score of 6.9, this is a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP POST with an oversized integer value in the JSON body, an action that does not require authentication. Because the issue is in the language core, deployment of the fix is essential to reduce the window of exposure.

Generated by OpenCVE AI on October 30, 2026 at 10:20 UTC.

Remediation

Vendor Workaround

Decode untrusted JSON with an integer decoder that rejects long digit runs before conversion: defmodule SafeJSON do def decode!(binary) do case JSON.decode(binary, :ok, integer: &safe_integer/1) do {decoded, :ok, ""} -> decoded _ -> raise ArgumentError, "invalid JSON" end end defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits) defp safe_integer(_digits), do: raise(ArgumentError, "integer too long") end In Phoenix, pass SafeJSON to Plug.Parsers as json_decoder instead of Phoenix.json_library().

OpenCVE Recommended Actions

  • Upgrade Elixir to a patched release: 1.18.6 or later, 1.19.7 or later, or 1.20.5 or later.
  • For Phoenix applications that cannot upgrade immediately, replace the default JSON parser with the SafeJSON module provided in the workaround, and configure Plug.Parsers to use that decoder.
  • Review any custom code that may call JSON.decode/1 directly and apply the safe integer logic or enforce an input size limit.

Generated by OpenCVE AI on October 30, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Title Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
First Time appeared Elixir-lang
Elixir-lang elixir
Weaknesses CWE-1284
CPEs cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*
Vendors & Products Elixir-lang
Elixir-lang elixir
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Elixir-lang Elixir
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-30T09:01:54.926Z

Reserved: 2026-10-23T12:45:01.103Z

Link: CVE-2026-115274

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T09:17:14.103

Modified: 2026-10-30T09:17:14.103

Link: CVE-2026-115274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T11:15:11Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input