CVE-2026-109821: Elixir URI parser CPU exhaustion via unbounded port digits

CVE-2026-109821 · Severity: info · Published 2026-10-30

Elixir's URI.parse function can be exploited to cause a denial of service through CPU exhaustion by supplying a URL with an extremely long port number containing hundreds of thousands of digits. When the parsed URI is subsequently rendered for logging, error messages, or storage, the conversion becomes computationally expensive and can consume several seconds of CPU time per request on certain Erlang/OTP versions. An attacker can sustain such requests to exhaust server CPU resources.

Technologies: Elixir-lang Elixir. Vendors: Elixir-lang.

Quick answers

Is CVE-2026-109821 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109821 being exploited in the wild.
How severe is CVE-2026-109821?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Elixir-lang Elixir 0.5.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, 1.20.0-rc.0 to 1.20.4.
Is there a fix for CVE-2026-109821?
Yes: fixed in Elixir 1.18.6, 1.19.7, 1.20.5. Until then: Reject long URLs before parsing them (e.g., anything above a few kilobytes) and reject parsed ports above 65535 before rendering or using the result. Alternatively, use URI.new/1 instead of URI.parse/1, which is unaffected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109821 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109821?
Check whether you run Elixir-lang Elixir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Elixir 1.18.6, 1.19.7, 1.20.5

Reject long URLs before parsing them (e.g., anything above a few kilobytes) and reject parsed ports above 65535 before rendering or using the result. Alternatively, use URI.new/1 instead of URI.parse/1, which is unaffected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later.

Technical details

The URI.parse/1 function in lib/uri.ex accepts unbounded port field lengths without validation, converting digit strings to integers via String.to_integer/1 and creating arbitrarily large bignum objects. Rendering these bigints back to text via :erlang.integer_to_binary/1 is quadratic in cost on Erlang/OTP versions 27, 28, and 29.0, causing multi-second delays for ports with hundreds of thousands of digits. An unauthenticated attacker can submit a crafted URL in a form field, JSON body, or other non-header source to trigger this behavior.

Affected products

  • Elixir-lang Elixir 0.5.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, 1.20.0-rc.0 to 1.20.4

Timeline

  • 2026-10-30: disclosed
  • 2026-10-30: advisory: CVE-2026-109821 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.