The eldap module of Erlang OTP does not bound the length of the port component in an LDAP referral URL before converting it to an integer. A malicious or compromised LDAP server can return a referral URL whose port field contains a very long string of digits, up to approximately one million or more. The eldap:parse_port/2 function passes that substring directly to Erlang's list_to_integer/1, which accepts arbitrarily large integers. Converting such a gigantic number consumes significant CPU time, degrading the responsiveness or causing timeout of the application that invoked eldap:parse_ldap_url/1, effectively creating a denial-of-service condition.

Erlang OTP releases that contain eldap 1.0.3 through 1.2.14.2, 1.2.15 through 1.2.16.1, and 1.3 through 1.3.1 are affected. That corresponds to OTP 17.0 up to 27.3.4.16, OTP 28.0 up to 28.5.0.5, and OTP 29.0 up to 29.0.5. The affected vendor is Erlang OTP.

The reported CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Explosion of a long port number requires an attacker to control the LDAP server or supply a crafted referral to the application. If such a referral reaches eldap:parse_ldap_url/1 without being parsed by the library itself, the internal conversion can be triggered, potentially slowing down the system for hundreds of milliseconds per referral. The impact is limited to availability and is local to the process that processes the referral.