CVE-2026-59696: Erlang/OTP stdlib URI parser denial of service via long port

CVE-2026-59696 · Severity: info · CVSS 6.9 · Published 2026-09-01

Erlang/OTP's URI parsing library contains a vulnerability that allows an attacker to cause a denial of service by sending URIs with extremely long port numbers. When an application parses a malicious URI, the parsing process becomes computationally expensive, consuming hundreds of milliseconds of CPU time and potentially freezing the application. Any Erlang-based service that accepts URIs from untrusted sources is vulnerable.

Technologies: Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-59696 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59696 being exploited in the wild.
How severe is CVE-2026-59696?
Informational severity, with a CVSS score of 6.9, published 1 September 2026.
Which products and versions are affected?
Erlang OTP 21.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-59696?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59696 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59696?
Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the uri_string module's uri_string:get_port/1 function, which passes the port substring directly to binary_to_integer/1 without validating the input length. When a port component contains an extremely long run of digits (up to ~1.26 million), the arbitrary-precision integer conversion succeeds but consumes hundreds of milliseconds of computational resources. The vulnerable code path is reachable from every URI authority-parsing route in uri_string:parse/1, including host, registered-name, and IPv4/IPv6 forms. Since parse/1 is the documented public interface for URI parsing, applications using it with untrusted input are exposed without additional configuration. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

Affected products

  • Erlang OTP 21.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang stdlib 3.5 before 6.2.2.5, 7.0 before 7.3.0.2, 8.0 before 8.0.4

Timeline

  • 2026-09-01: disclosed
  • 2026-09-08: other: CVE updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.