Executive brief
A vulnerability in the Elixir programming language's version handling module can allow an attacker to crash or slow down an application. By providing a specially crafted, very long version number (such as in an HTTP request or package metadata), an attacker can exhaust the server's processing power and memory. This results in a denial-of-service, making the application unavailable to legitimate users.
Technical details
An uncontrolled resource consumption vulnerability exists in Elixir's 'Version' module due to unbounded integer parsing of version components. The parser converts numeric components (major, minor, patch, etc.) to arbitrary-precision integers using ':erlang.binary_to_integer/1' without length validation. An attacker can provide a large numeric string (approx. 1MB) to trigger super-linear CPU usage that pins BEAM schedulers or raises a 'SystemLimitError', crashing the process. This is exploitable via public functions like 'Version.parse/1' and 'Version.match?/3' when they process untrusted input from HTTP parameters or manifest files. The issue is fixed in Elixir 1.20.1 by limiting version number components to 14 bytes.
Affected products
- Elixir Team Elixir 1.5.0 to 1.20.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: patched: Fixed in Elixir v1.20.1
- 2026-06-09: advisory