Executive brief
Erlang/OTP's URI parsing library contains a vulnerability that allows an attacker to cause a denial of service by sending URIs with extremely long port numbers. When an application parses a malicious URI, the parsing process becomes computationally expensive, consuming hundreds of milliseconds of CPU time and potentially freezing the application. Any Erlang-based service that accepts URIs from untrusted sources is vulnerable.
Technical details
The vulnerability exists in the uri_string module's uri_string:get_port/1 function, which passes the port substring directly to binary_to_integer/1 without validating the input length. When a port component contains an extremely long run of digits (up to ~1.26 million), the arbitrary-precision integer conversion succeeds but consumes hundreds of milliseconds of computational resources. The vulnerable code path is reachable from every URI authority-parsing route in uri_string:parse/1, including host, registered-name, and IPv4/IPv6 forms. Since parse/1 is the documented public interface for URI parsing, applications using it with untrusted input are exposed without additional configuration. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.
Affected products
- Erlang OTP 21.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang stdlib 3.5 before 6.2.2.5, 7.0 before 7.3.0.2, 8.0 before 8.0.4
Timeline
- 2026-09-01: disclosed
- 2026-09-08: other: CVE updated