The vulnerability arises from the Elixir standard library’s Version module, which converts unrestricted numeric components of a version string into arbitrary‑precision integers without validating length. A single component consisting of a large sequence of digits triggers a non‑yielding conversion that consumes CPU time and, if the component is even larger, raises an uncaught SystemLimitError that crashes the calling process. This results in a denial of service that can be observed as prolonged CPU usage or an application crash. The weakness is classified as CWE‑400, uncontrolled resource consumption, and also as CWE‑770, reflecting the lack of bounds on resource allocation.

Elixir, released by elixir‑lang, versions from 1.5.0 up to, but excluding, 1.20.1 are affected. Any installation of these releases that parses untrusted version strings—such as user‑supplied HTTP parameters, package metadata, or dependency manifest fields—faces the risk.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score is 0.00152, below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation data. The attack vector is inferred to be remote and unauthenticated, as the vulnerable parsing functions are publicly documented entry points and can be invoked by any requester that supplies a malicious version string. Successful exploitation would exhaust CPU and memory resources, potentially halting an application or the BEAM scheduler.