CVE-2026-59696 - Vulnerability Details

- uri_string does not bound the port component of a URI before integer conversion

Description

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.

Published: 2026-09-01

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

uri_string:get_port/1 passes the port substring to integer conversion without a length check, allowing a malicious URI to contain an extremely long digit sequence. The conversion triggers arbitrary-precision arithmetic that consumes significant CPU time, degrading the availability of any Erlang/OTP program that parses such a URI and potentially causing denial of service if the call blocks the process.

Affected Systems

The flaw exists in OTP releases from 21.0 up to but excluding 27.3.4.17, 28.0 up to 28.5.0.6, and 29.0 up to 29.0.6. These correspond to stdlib versions before 6.2.2.5, 7.3.0.2, and 8.0.4, respectively. Any application that uses Erlang/OTP stdlib and parses URIs from untrusted sources is affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote because the application can receive external URIs; the exploit simply requires submitting a specially crafted URI, after which the parsing function blocks the process. The lack of a port length bound increases the risk of denial of service without additional controls.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`21.0`	affected	< 27.3.4.17
`28.0`	affected	< 28.5.0.6
`29.0`	affected	< 29.0.6

Erlang

OTP

unaffected

Version	Status	Constraints
`3.5`	affected	< 6.2.2.5
`7.0`	affected	< 7.3.0.2
`8.0`	affected	< 8.0.4

Erlang

OTP

unaffected

Version	Status	Constraints
`29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[21.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—
`[3.5,6.2.2.5)`	affected	generic	—
`[7.0,7.3.0.2)`	affected	generic	—
`[8.0,8.0.4)`	affected	generic	—
`29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[21.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[3.5,6.2.2.5)`	affected	generic	—
`[7.0,7.3.0.2)`	affected	generic	—
`[8.0,8.0.4)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Erlang/OTP to the earliest unaffected release (OTP 27.3.4.17, 28.5.0.6, or 29.0.6 or later).
If an upgrade is not possible, restrict the length of the port field before calling uri_string:parse or replace it with a custom parser that validates a reasonable port range.
Implement application‑level timeouts or guard these calls with a separate process to prevent a single bad URI from exhausting system resources.

Generated by OpenCVE AI on September 1, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00421.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-59696.html
https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d
https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa
https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2
https://osv.dev/vulnerability/EEF-CVE-2026-59696
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility. This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.
Title		uri_string does not bound the port component of a URI before integer conversion
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-1284
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-59696.html https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2 https://osv.dev/vulnerability/EEF-CVE-2026-59696 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:37:33.697Z

Updated: 2026-09-08T01:07:47.936Z

Reserved: 2026-07-06T14:05:47.003Z

Link: CVE-2026-59696

Vulnrichment

Updated: 2026-09-01T15:54:46.605Z

NVD

Status : Deferred

Published: 2026-09-01T15:17:22.250

Modified: 2026-09-08T01:17:51.663

Link: CVE-2026-59696

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-01T16:00:13Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object