CVE-2026-115274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115274", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-23T12:45:01.103Z", "datePublished": "2026-10-30T08:57:16.847Z", "dateUpdated": "2026-10-30T16:51:45.396Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.JSON'", "elixir_json"], "packageName": "elixir", "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git", "product": "elixir", "programFiles": ["lib/json.ex", "src/elixir_json.erl"], "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [{"lessThan": "1.18.6", "status": "affected", "version": "1.18.0-rc.0", "versionType": "semver"}, {"lessThan": "1.19.7", "status": "affected", "version": "1.19.0-rc.0", "versionType": "semver"}, {"lessThan": "1.20.5", "status": "affected", "version": "1.20.0-rc.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.JSON'", "elixir_json"], "packageName": "elixir-lang/elixir", "packageURL": "pkg:github/elixir-lang/elixir", "product": "elixir", "programFiles": ["lib/elixir/lib/json.ex", "lib/elixir/src/elixir_json.erl"], "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [{"changes": [{"at": "c81f12265919c34a0d5134f1905a4eb4edaea1c2", "status": "unaffected"}, {"at": "7154e8781da9fd016a973ea01776a011c8b5726a", "status": "unaffected"}, {"at": "cd158efacdc10b30232864251747dff9b8387dfe", "status": "unaffected"}, {"at": "ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "793c1147210388587defb649f25f293ffbfa6b1b", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.6", "versionStartIncluding": "1.18.0-rc.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.7", "versionStartIncluding": "1.19.0-rc.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.20.5", "versionStartIncluding": "1.20.0-rc.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "David Vieira Kurz"}, {"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "reporter", "value": "David Vieira Kurz"}, {"lang": "en", "type": "remediation developer", "value": "Jos\u00e9 Valim"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-10-25T12:21:17.000Z", "datePublic": "2026-10-30T08:57:17.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's <code>JSON</code> module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.</p>\n<p><code>JSON.decode/1</code> and <code>JSON.decode!/1</code> convert each integer literal with <code>erlang:binary_to_integer/1</code> and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises <code>SystemLimitError</code>. Applications generated by <code>phx.new</code> decode request bodies with <code>JSON</code> in <code>Plug.Parsers</code>, before routing and authentication.</p>\n<p>This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's `JSON` module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\n`JSON.decode/1` and `JSON.decode!/1` convert each integer literal with `erlang:binary_to_integer/1` and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises `SystemLimitError`. Applications generated by `phx.new` decode request bodies with `JSON` in `Plug.Parsers`, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."}], "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with <code>JSON</code>, including new Phoenix applications by default.</p>"}, {"base64": false, "type": "text/markdown", "value": "An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with `JSON`, including new Phoenix applications by default."}], "value": "An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with JSON, including new Phoenix applications by default."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-30T09:01:54.926Z"}, "references": [{"name": "Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir", "tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h"}, {"name": "EEF CNA record for CVE-2026-115274", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-115274.html"}, {"name": "OSV record EEF-CVE-2026-115274", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-115274"}, {"name": "Introducing commit 793c114 in elixir-lang/elixir", "tags": ["related"], "url": "https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b"}, {"name": "Fix commit c81f122 in elixir-lang/elixir", "tags": ["patch"], "url": "https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2"}, {"name": "Fix commit 7154e87 in elixir-lang/elixir", "tags": ["patch"], "url": "https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a"}, {"name": "Fix commit cd158ef in elixir-lang/elixir", "tags": ["patch"], "url": "https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe"}, {"name": "Fix commit ee5cc23 in elixir-lang/elixir", "tags": ["patch"], "url": "https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396"}], "source": {"discovery": "EXTERNAL"}, "title": "Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Decode untrusted JSON with an <code>integer</code> decoder that rejects long digit runs before conversion:</p>\n<pre><code class=\"language-elixir\">defmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &amp;safe_integer/1) do\n {decoded, :ok, \"\"} -&gt; decoded\n _ -&gt; raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) &lt;= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n</code></pre>\n<p>In Phoenix, pass <code>SafeJSON</code> to <code>Plug.Parsers</code> as <code>json_decoder</code> instead of <code>Phoenix.json_library()</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "Decode untrusted JSON with an `integer` decoder that rejects long digit runs before conversion:\n\n```elixir\ndefmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &safe_integer/1) do\n {decoded, :ok, \"\"} -> decoded\n _ -> raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n```\n\nIn Phoenix, pass `SafeJSON` to `Plug.Parsers` as `json_decoder` instead of `Phoenix.json_library()`."}], "value": "Decode untrusted JSON with an integer decoder that rejects long digit runs before conversion:\n\ndefmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &safe_integer/1) do\n {decoded, :ok, \"\"} -> decoded\n _ -> raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n\nIn Phoenix, pass SafeJSON to Plug.Parsers as json_decoder instead of Phoenix.json_library()."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>Build <code>body = \"[\" &lt;&gt; Enum.map_join(1..7, \",\", fn _ -&gt; String.duplicate(\"9\", 1_000_000) end) &lt;&gt; \"]\"</code>, a body of about 7 MB.</li>\n<li><code>JSON.decode(body)</code> returns <code>{:ok, ...}</code> after about one second of CPU.</li>\n<li><code>JSON.decode(String.duplicate(\"9\", 1_000_000))</code> takes 100 to 300 times as long as <code>JSON.decode(\"\\\"\" &lt;&gt; String.duplicate(\"9\", 1_000_000) &lt;&gt; \"\\\"\")</code>.</li>\n<li><code>JSON.decode(String.duplicate(\"9\", 1_400_000))</code> raises <code>SystemLimitError</code>.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. Build `body = \"[\" <> Enum.map_join(1..7, \",\", fn _ -> String.duplicate(\"9\", 1_000_000) end) <> \"]\"`, a body of about 7 MB.\n2. `JSON.decode(body)` returns `{:ok, ...}` after about one second of CPU.\n3. `JSON.decode(String.duplicate(\"9\", 1_000_000))` takes 100 to 300 times as long as `JSON.decode(\"\\\"\" <> String.duplicate(\"9\", 1_000_000) <> \"\\\"\")`.\n4. `JSON.decode(String.duplicate(\"9\", 1_400_000))` raises `SystemLimitError`."}], "value": "* Build body = \"[\" <> Enum.map_join(1..7, \",\", fn _ -> String.duplicate(\"9\", 1_000_000) end) <> \"]\", a body of about 7 MB.\n* JSON.decode(body) returns {:ok, ...} after about one second of CPU.\n* JSON.decode(String.duplicate(\"9\", 1_000_000)) takes 100 to 300 times as long as JSON.decode(\"\\\"\" <> String.duplicate(\"9\", 1_000_000) <> \"\\\"\").\n* JSON.decode(String.duplicate(\"9\", 1_400_000)) raises SystemLimitError."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Default integer decoder</strong></p>\n<p><code>JSON.decode/1</code> and <code>JSON.decode!/1</code> call <code>JSON.decode/3</code> without an <code>integer</code> decoder. Up to the removal of Erlang/OTP 26 support, <code>JSON.decode/3</code> used the vendored <code>elixir_json</code> module, whose default is <code>fun erlang:binary_to_integer/1</code>. It now calls OTP's <code>:json.decode/3</code>, which has the same default. The <code>JSON.decode/3</code> documentation names <code>&amp;String.to_integer/1</code> as the default, which converts the same way.</p>\n<p><strong>2. Unbounded conversion</strong></p>\n<p>The decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises <code>SystemLimitError</code>, which <code>JSON.decode/3</code> does not catch.</p>\n<p><strong>3. Reach</strong></p>\n<p><code>phx.new</code> sets <code>config :phoenix, :json_library, JSON</code>, and the generated endpoint passes <code>Phoenix.json_library()</code> to <code>Plug.Parsers</code> as <code>json_decoder</code>. <code>Plug.Parsers</code> runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the <code>SystemLimitError</code> into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its <code>decoding_integer_digit_limit</code> (1024 by default) before conversion.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Default integer decoder**\n\n`JSON.decode/1` and `JSON.decode!/1` call `JSON.decode/3` without an `integer` decoder. Up to the removal of Erlang/OTP 26 support, `JSON.decode/3` used the vendored `elixir_json` module, whose default is `fun erlang:binary_to_integer/1`. It now calls OTP's `:json.decode/3`, which has the same default. The `JSON.decode/3` documentation names `&String.to_integer/1` as the default, which converts the same way.\n\n**2. Unbounded conversion**\n\nThe decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises `SystemLimitError`, which `JSON.decode/3` does not catch.\n\n**3. Reach**\n\n`phx.new` sets `config :phoenix, :json_library, JSON`, and the generated endpoint passes `Phoenix.json_library()` to `Plug.Parsers` as `json_decoder`. `Plug.Parsers` runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the `SystemLimitError` into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its `decoding_integer_digit_limit` (1024 by default) before conversion."}], "value": "1. Default integer decoder\n\nJSON.decode/1 and JSON.decode!/1 call JSON.decode/3 without an integer decoder. Up to the removal of Erlang/OTP 26 support, JSON.decode/3 used the vendored elixir_json module, whose default is fun erlang:binary_to_integer/1. It now calls OTP's :json.decode/3, which has the same default. The JSON.decode/3 documentation names &String.to_integer/1 as the default, which converts the same way.\n\n2. Unbounded conversion\n\nThe decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises SystemLimitError, which JSON.decode/3 does not catch.\n\n3. Reach\n\nphx.new sets config :phoenix, :json_library, JSON, and the generated endpoint passes Phoenix.json_library() to Plug.Parsers as json_decoder. Plug.Parsers runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the SystemLimitError into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its decoding_integer_digit_limit (1024 by default) before conversion."}]}, "adp": [{"references": [{"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:51:17.679403Z", "id": "CVE-2026-115274", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:51:45.396Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115274", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:51:17.679403Z"}}}], "references": [{"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:51:40.079Z"}}], "cna": {"title": "Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Vieira Kurz"}, {"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "reporter", "value": "David Vieira Kurz"}, {"lang": "en", "type": "remediation developer", "value": "Jos\u00e9 Valim"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with JSON, including new Phoenix applications by default.", "supportingMedia": [{"type": "text/html", "value": "<p>An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with <code>JSON</code>, including new Phoenix applications by default.</p>", "base64": false}, {"type": "text/markdown", "value": "An unauthenticated client that sends a JSON body with integer literals of about a million digits makes the server spend about a second of CPU per request and allocate large bignums. Sustained requests exhaust CPU on applications that decode untrusted JSON with `JSON`, including new Phoenix applications by default.", "base64": false}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "modules": ["'Elixir.JSON'", "elixir_json"], "product": "elixir", "versions": [{"status": "affected", "version": "1.18.0-rc.0", "lessThan": "1.18.6", "versionType": "semver"}, {"status": "affected", "version": "1.19.0-rc.0", "lessThan": "1.19.7", "versionType": "semver"}, {"status": "affected", "version": "1.20.0-rc.0", "lessThan": "1.20.5", "versionType": "semver"}], "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git", "packageName": "elixir", "programFiles": ["lib/json.ex", "src/elixir_json.erl"], "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}]}, {"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "modules": ["'Elixir.JSON'", "elixir_json"], "product": "elixir", "versions": [{"status": "affected", "changes": [{"at": "c81f12265919c34a0d5134f1905a4eb4edaea1c2", "status": "unaffected"}, {"at": "7154e8781da9fd016a973ea01776a011c8b5726a", "status": "unaffected"}, {"at": "cd158efacdc10b30232864251747dff9b8387dfe", "status": "unaffected"}, {"at": "ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396", "status": "unaffected"}], "version": "793c1147210388587defb649f25f293ffbfa6b1b", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/elixir-lang/elixir", "packageName": "elixir-lang/elixir", "programFiles": ["lib/elixir/lib/json.ex", "lib/elixir/src/elixir_json.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}]}], "datePublic": "2026-10-30T08:57:17.000Z", "references": [{"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h", "name": "Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-115274.html", "name": "EEF CNA record for CVE-2026-115274", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115274", "name": "OSV record EEF-CVE-2026-115274", "tags": ["related"]}, {"url": "https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b", "name": "Introducing commit 793c114 in elixir-lang/elixir", "tags": ["related"]}, {"url": "https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2", "name": "Fix commit c81f122 in elixir-lang/elixir", "tags": ["patch"]}, {"url": "https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a", "name": "Fix commit 7154e87 in elixir-lang/elixir", "tags": ["patch"]}, {"url": "https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe", "name": "Fix commit cd158ef in elixir-lang/elixir", "tags": ["patch"]}, {"url": "https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396", "name": "Fix commit ee5cc23 in elixir-lang/elixir", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Decode untrusted JSON with an integer decoder that rejects long digit runs before conversion:\n\ndefmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &safe_integer/1) do\n {decoded, :ok, \"\"} -> decoded\n _ -> raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n\nIn Phoenix, pass SafeJSON to Plug.Parsers as json_decoder instead of Phoenix.json_library().", "supportingMedia": [{"type": "text/html", "value": "<p>Decode untrusted JSON with an <code>integer</code> decoder that rejects long digit runs before conversion:</p>\n<pre><code class=\"language-elixir\">defmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &amp;safe_integer/1) do\n {decoded, :ok, \"\"} -&gt; decoded\n _ -&gt; raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) &lt;= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n</code></pre>\n<p>In Phoenix, pass <code>SafeJSON</code> to <code>Plug.Parsers</code> as <code>json_decoder</code> instead of <code>Phoenix.json_library()</code>.</p>", "base64": false}, {"type": "text/markdown", "value": "Decode untrusted JSON with an `integer` decoder that rejects long digit runs before conversion:\n\n```elixir\ndefmodule SafeJSON do\n def decode!(binary) do\n case JSON.decode(binary, :ok, integer: &safe_integer/1) do\n {decoded, :ok, \"\"} -> decoded\n _ -> raise ArgumentError, \"invalid JSON\"\n end\n end\n\n defp safe_integer(digits) when byte_size(digits) <= 1024, do: String.to_integer(digits)\n defp safe_integer(_digits), do: raise(ArgumentError, \"integer too long\")\nend\n```\n\nIn Phoenix, pass `SafeJSON` to `Plug.Parsers` as `json_decoder` instead of `Phoenix.json_library()`.", "base64": false}]}], "dateAssigned": "2026-10-25T12:21:17.000Z", "descriptions": [{"lang": "en", "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's <code>JSON</code> module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.</p>\n<p><code>JSON.decode/1</code> and <code>JSON.decode!/1</code> convert each integer literal with <code>erlang:binary_to_integer/1</code> and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises <code>SystemLimitError</code>. Applications generated by <code>phx.new</code> decode request bodies with <code>JSON</code> in <code>Plug.Parsers</code>, before routing and authentication.</p>\n<p>This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's `JSON` module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\n`JSON.decode/1` and `JSON.decode!/1` convert each integer literal with `erlang:binary_to_integer/1` and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises `SystemLimitError`. Applications generated by `phx.new` decode request bodies with `JSON` in `Plug.Parsers`, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.6", "versionStartIncluding": "1.18.0-rc.0"}, {"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.19.7", "versionStartIncluding": "1.19.0-rc.0"}, {"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.20.5", "versionStartIncluding": "1.20.0-rc.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-30T09:01:54.926Z"}, "x_proofOfConcept": [{"lang": "en", "value": "* Build body = \"[\" <> Enum.map_join(1..7, \",\", fn _ -> String.duplicate(\"9\", 1_000_000) end) <> \"]\", a body of about 7 MB.\n* JSON.decode(body) returns {:ok, ...} after about one second of CPU.\n* JSON.decode(String.duplicate(\"9\", 1_000_000)) takes 100 to 300 times as long as JSON.decode(\"\\\"\" <> String.duplicate(\"9\", 1_000_000) <> \"\\\"\").\n* JSON.decode(String.duplicate(\"9\", 1_400_000)) raises SystemLimitError.", "supportingMedia": [{"type": "text/html", "value": "<ol>\n<li>Build <code>body = \"[\" &lt;&gt; Enum.map_join(1..7, \",\", fn _ -&gt; String.duplicate(\"9\", 1_000_000) end) &lt;&gt; \"]\"</code>, a body of about 7 MB.</li>\n<li><code>JSON.decode(body)</code> returns <code>{:ok, ...}</code> after about one second of CPU.</li>\n<li><code>JSON.decode(String.duplicate(\"9\", 1_000_000))</code> takes 100 to 300 times as long as <code>JSON.decode(\"\\\"\" &lt;&gt; String.duplicate(\"9\", 1_000_000) &lt;&gt; \"\\\"\")</code>.</li>\n<li><code>JSON.decode(String.duplicate(\"9\", 1_400_000))</code> raises <code>SystemLimitError</code>.</li>\n</ol>", "base64": false}, {"type": "text/markdown", "value": "1. Build `body = \"[\" <> Enum.map_join(1..7, \",\", fn _ -> String.duplicate(\"9\", 1_000_000) end) <> \"]\"`, a body of about 7 MB.\n2. `JSON.decode(body)` returns `{:ok, ...}` after about one second of CPU.\n3. `JSON.decode(String.duplicate(\"9\", 1_000_000))` takes 100 to 300 times as long as `JSON.decode(\"\\\"\" <> String.duplicate(\"9\", 1_000_000) <> \"\\\"\")`.\n4. `JSON.decode(String.duplicate(\"9\", 1_400_000))` raises `SystemLimitError`.", "base64": false}]}], "x_technicalAnalysis": [{"lang": "en", "value": "1. Default integer decoder\n\nJSON.decode/1 and JSON.decode!/1 call JSON.decode/3 without an integer decoder. Up to the removal of Erlang/OTP 26 support, JSON.decode/3 used the vendored elixir_json module, whose default is fun erlang:binary_to_integer/1. It now calls OTP's :json.decode/3, which has the same default. The JSON.decode/3 documentation names &String.to_integer/1 as the default, which converts the same way.\n\n2. Unbounded conversion\n\nThe decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises SystemLimitError, which JSON.decode/3 does not catch.\n\n3. Reach\n\nphx.new sets config :phoenix, :json_library, JSON, and the generated endpoint passes Phoenix.json_library() to Plug.Parsers as json_decoder. Plug.Parsers runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the SystemLimitError into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its decoding_integer_digit_limit (1024 by default) before conversion.", "supportingMedia": [{"type": "text/html", "value": "<p><strong>1. Default integer decoder</strong></p>\n<p><code>JSON.decode/1</code> and <code>JSON.decode!/1</code> call <code>JSON.decode/3</code> without an <code>integer</code> decoder. Up to the removal of Erlang/OTP 26 support, <code>JSON.decode/3</code> used the vendored <code>elixir_json</code> module, whose default is <code>fun erlang:binary_to_integer/1</code>. It now calls OTP's <code>:json.decode/3</code>, which has the same default. The <code>JSON.decode/3</code> documentation names <code>&amp;String.to_integer/1</code> as the default, which converts the same way.</p>\n<p><strong>2. Unbounded conversion</strong></p>\n<p>The decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises <code>SystemLimitError</code>, which <code>JSON.decode/3</code> does not catch.</p>\n<p><strong>3. Reach</strong></p>\n<p><code>phx.new</code> sets <code>config :phoenix, :json_library, JSON</code>, and the generated endpoint passes <code>Phoenix.json_library()</code> to <code>Plug.Parsers</code> as <code>json_decoder</code>. <code>Plug.Parsers</code> runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the <code>SystemLimitError</code> into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its <code>decoding_integer_digit_limit</code> (1024 by default) before conversion.</p>", "base64": false}, {"type": "text/markdown", "value": "**1. Default integer decoder**\n\n`JSON.decode/1` and `JSON.decode!/1` call `JSON.decode/3` without an `integer` decoder. Up to the removal of Erlang/OTP 26 support, `JSON.decode/3` used the vendored `elixir_json` module, whose default is `fun erlang:binary_to_integer/1`. It now calls OTP's `:json.decode/3`, which has the same default. The `JSON.decode/3` documentation names `&String.to_integer/1` as the default, which converts the same way.\n\n**2. Unbounded conversion**\n\nThe decoder scans the digits of an integer literal and passes the whole run to the conversion. Nothing limits the run's length, so the cost grows faster than linearly with the number of digits. At one million digits an integer literal costs 100 to 300 times as much CPU as a string literal of the same length. Above about 1.29 million digits the conversion raises `SystemLimitError`, which `JSON.decode/3` does not catch.\n\n**3. Reach**\n\n`phx.new` sets `config :phoenix, :json_library, JSON`, and the generated endpoint passes `Phoenix.json_library()` to `Plug.Parsers` as `json_decoder`. `Plug.Parsers` runs before routing and authentication and accepts bodies up to 8 MB by default. It rescues the `SystemLimitError` into a 400 response after the CPU cost is spent. Jason, the previous default, rejects integer literals longer than its `decoding_integer_digit_limit` (1024 by default) before conversion.", "base64": false}]}]}}, "cveMetadata": {"cveId": "CVE-2026-115274", "state": "PUBLISHED", "dateUpdated": "2026-10-30T16:51:45.396Z", "dateReserved": "2026-10-23T12:45:01.103Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-10-30T08:57:16.847Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.JSON'", "elixir_json"], "packageName": "elixir", "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git", "product": "elixir", "programFiles": ["lib/json.ex", "src/elixir_json.erl"], "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [{"lessThan": "1.18.6", "status": "affected", "version": "1.18.0-rc.0", "versionType": "semver"}, {"lessThan": "1.19.7", "status": "affected", "version": "1.19.0-rc.0", "versionType": "semver"}, {"lessThan": "1.20.5", "status": "affected", "version": "1.20.0-rc.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.JSON'", "elixir_json"], "packageName": "elixir-lang/elixir", "packageURL": "pkg:github/elixir-lang/elixir", "product": "elixir", "programFiles": ["lib/elixir/lib/json.ex", "lib/elixir/src/elixir_json.erl"], "programRoutines": [{"name": "'Elixir.JSON':decode/1"}, {"name": "'Elixir.JSON':'decode!'/1"}, {"name": "'Elixir.JSON':decode/3"}, {"name": "elixir_json:decode/3"}], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "versions": [{"changes": [{"at": "c81f12265919c34a0d5134f1905a4eb4edaea1c2", "status": "unaffected"}, {"at": "7154e8781da9fd016a973ea01776a011c8b5726a", "status": "unaffected"}, {"at": "cd158efacdc10b30232864251747dff9b8387dfe", "status": "unaffected"}, {"at": "ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "793c1147210388587defb649f25f293ffbfa6b1b", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."}], "id": "CVE-2026-115274", "lastModified": "2026-10-30T19:39:14.897", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115274", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:51:17.679403Z", "version": "2.0.3"}}]}, "published": "2026-10-30T09:17:14.103", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-115274.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-115274"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "elixir: Elixir: Denial of Service via unbounded integer parsing in JSON module", "id": "2563895", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563895"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.", "A flaw was found in Elixir. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting system resources. The standard library's JSON parsing module fails to restrict the length of integer numbers during data decoding. By submitting a specially crafted JSON payload containing excessively long numbers, an attacker can monopolize processor time and memory, leading to severe performance degradation or application crashes."], "name": "CVE-2026-115274", "public_date": "2026-10-30T08:57:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115274\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115274\nhttps://cna.erlef.org/cves/CVE-2026-115274.html\nhttps://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a\nhttps://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b\nhttps://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2\nhttps://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe\nhttps://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396\nhttps://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h\nhttps://osv.dev/vulnerability/EEF-CVE-2026-115274"], "statement": "This vulnerability is rated as Moderate severity because an unauthenticated remote attacker can cause resource exhaustion and service disruption, but cannot compromise confidentiality, modify data, or execute arbitrary code. Red Hat Enterprise Linux and other core Red Hat product offerings do not ship or maintain the Elixir runtime, significantly limiting enterprise exposure. Impact is primarily restricted to custom-developed applications consuming untrusted JSON payloads through standard decoding functions without application-level length constraints.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.18.0-rc.0,1.18.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.19.0-rc.0,1.19.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.20.0-rc.0,1.20.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "elixir", "source": "cna", "vendor": "elixir-lang"}, "product": "elixir", "vendor": "elixir-lang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "793c1147210388587defb649f25f293ffbfa6b1b"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "elixir", "source": "cna", "vendor": "elixir-lang"}, "product": "elixir", "vendor": "elixir-lang"}], "created": "2026-10-30T10:30:11.625297+00:00", "updated": "2026-11-06T02:45:07.224671+00:00", "vendors": ["elixir-lang", "elixir-lang$PRODUCT$elixir"]}