Weakness Type (CWE)

CWE-400 — CWE-400 Uncontrolled Resource Consumption

CAPEC

CVSS 4.0 Score

5.1

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability description

Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.

The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.

This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.

This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.

This issue affects Elixir: from 1.5.0 before 1.20.1.

Affected

pkg:otp/elixir

Module Source File Routine
Version lib/version.ex Version.parse/1
Version.Parser Version.parse!/1
Version.match?/3
Version.compare/2
Version.parse_requirement/1
Version.Parser.parse_version/2
Version.Parser.parse_digits/2
Version.Parser.require_digits/1
Version.Parser.convert_parts_to_integer/2
Status Type Version Changes / Fixed in
affected semver ⓘ 1.5.0 < 1.20.1

pkg:github/elixir-lang/elixir

Module Source File Routine
Version lib/elixir/lib/version.ex Version.parse/1
Version.Parser Version.parse!/1
Version.match?/3
Version.compare/2
Version.parse_requirement/1
Version.Parser.parse_version/2
Version.Parser.parse_digits/2
Version.Parser.require_digits/1
Version.Parser.convert_parts_to_integer/2
Status Type Version Changes / Fixed in
affected git ⓘ 63e186aea9 < c64417d72f

References

Credits

  • Finder: Peter Ullrich
  • Remediation developer: José Valim
  • Remediation reviewer: Eric Meadows-Jönsson
  • Analyst: Jonatan Männchen

CVE record as JSON:  GET /cves/CVE-2026-49762.json
OSV record as JSON:  GET /osv/EEF-CVE-2026-49762.json