# CVE-2026-59696: Erlang/OTP stdlib URI parser denial of service via long port

Source: https://junglewise.ai/threats/cve-2026-59696-erlang-otp-stdlib-uri-parser-denial-of-service-via-long-port  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59696 · Severity: info · CVSS 6.9 · Published 2026-09-01

Erlang/OTP's URI parsing library contains a vulnerability that allows an attacker to cause a denial of service by sending URIs with extremely long port numbers. When an application parses a malicious URI, the parsing process becomes computationally expensive, consuming hundreds of milliseconds of CPU time and potentially freezing the application. Any Erlang-based service that accepts URIs from untrusted sources is vulnerable.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-59696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59696 being exploited in the wild.

**How severe is CVE-2026-59696?** Informational severity, with a CVSS score of 6.9, published 1 September 2026.

**Which products and versions are affected?** Erlang OTP 21.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.

**Is there a fix for CVE-2026-59696?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59696 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59696?** Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the uri_string module's uri_string:get_port/1 function, which passes the port substring directly to binary_to_integer/1 without validating the input length. When a port component contains an extremely long run of digits (up to ~1.26 million), the arbitrary-precision integer conversion succeeds but consumes hundreds of milliseconds of computational resources. The vulnerable code path is reachable from every URI authority-parsing route in uri_string:parse/1, including host, registered-name, and IPv4/IPv6 forms. Since parse/1 is the documented public interface for URI parsing, applications using it with untrusted input are exposed without additional configuration. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

## Affected products

- Erlang OTP 21.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang stdlib 3.5 before 6.2.2.5, 7.0 before 7.3.0.2, 8.0 before 8.0.4

## Timeline

- 2026-09-01: disclosed
- 2026-09-08: other: CVE updated

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-59696.html](https://cna.erlef.org/cves/CVE-2026-59696.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)