Is CVE-2026-115274 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115274 being exploited in the wild.

How severe is CVE-2026-115274?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Elixir-lang Elixir 1.18.0-rc.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, 1.20.0-rc.0 to 1.20.4.

How is CVE-2026-115274 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115274?

Check whether you run Elixir-lang Elixir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115274: Elixir JSON.decode unbounded integer parsing denial of service

CVE-2026-115274 · Severity: info · Published 2026-10-30

Elixir's JSON module contains a vulnerability in integer parsing that allows unauthenticated attackers to cause denial of service by sending specially crafted JSON documents with very large integer literals. A few megabytes of malicious JSON can consume significant CPU and memory resources, potentially making web applications unresponsive. Phoenix applications created with default settings are particularly vulnerable since they decode untrusted JSON before authentication.

Technologies: Elixir-lang Elixir. Vendors: Elixir-lang.

Quick answers

Is CVE-2026-115274 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115274 being exploited in the wild.
How severe is CVE-2026-115274?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Elixir-lang Elixir 1.18.0-rc.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, 1.20.0-rc.0 to 1.20.4.
Is there a fix for CVE-2026-115274?: Yes: fixed in Elixir 1.18.6, 1.19.7, 1.20.5. Until then: For affected versions, decode untrusted JSON with a custom integer decoder that rejects digit runs exceeding 1024 characters before conversion. In Phoenix applications, replace Phoenix.json_library() with this safe decoder when configuring Plug.Parsers.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115274 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115274?: Check whether you run Elixir-lang Elixir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elixir 1.18.6, 1.19.7, 1.20.5

For affected versions, decode untrusted JSON with a custom integer decoder that rejects digit runs exceeding 1024 characters before conversion. In Phoenix applications, replace Phoenix.json_library() with this safe decoder when configuring Plug.Parsers.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-30"}]

Technical details

The JSON.decode/1 and JSON.decode!/1 functions use erlang:binary_to_integer/1 without bounds checking on digit length. Integer literals with a million digits consume 100-300 times more CPU than equivalent string literals, and literals exceeding ~1.29 million digits trigger a SystemLimitError. This allows low-effort resource exhaustion attacks against any application parsing untrusted JSON, with Phoenix's Plug.Parsers processing the payload before routing and authentication.

Affected products

Elixir-lang Elixir 1.18.0-rc.0 to 1.18.5, 1.19.0-rc.0 to 1.19.6, 1.20.0-rc.0 to 1.20.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.