Skip to content
Heist/ feed
Medium

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Type: advisorySource: Official CVE List1 source record

Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects elixir: from 0.9.3 before 1.20.1.

Announced Source revision 1
Original source ↗

CVE-2026-49762

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-49762

elixir

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

elixir

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-lang/elixir",
    "vendor": "elixir-lang",
    "modules": [
      "'Elixir.Version'",
      "'Elixir.Version.Parser'"
    ],
    "product": "elixir",
    "versions": [
      {
        "status": "affected",
        "version": "0.9.3",
        "lessThan": "1.20.1",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
    "packageName": "elixir",
    "programFiles": [
      "lib/version.ex"
    ],
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Version':parse/1"
      },
      {
        "name": "'Elixir.Version':parse!/1"
      },
      {
        "name": "'Elixir.Version':match?/3"
      },
      {
        "name": "'Elixir.Version':compare/2"
      },
      {
        "name": "'Elixir.Version':parse_requirement/1"
      },
      {
        "name": "'Elixir.Version.Parser':parse_version/2"
      },
      {
        "name": "'Elixir.Version.Parser':parse_digits/2"
      },
      {
        "name": "'Elixir.Version.Parser':require_digits/1"
      },
      {
        "name": "'Elixir.Version.Parser':convert_parts_to_integer/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-lang/elixir",
    "vendor": "elixir-lang",
    "modules": [
      "'Elixir.Version'",
      "'Elixir.Version.Parser'"
    ],
    "product": "elixir",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
            "status": "unaffected"
          },
          {
            "at": "64e6707233464c3e55a9ca6b44019aed25b0390a",
            "status": "unaffected"
          }
        ],
        "version": "057691722eb8cfe315f5606358954a2b173ff7a3",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/elixir-lang/elixir",
    "packageName": "elixir-lang/elixir",
    "programFiles": [
      "lib/elixir/lib/version.ex"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Version':parse/1"
      },
      {
        "name": "'Elixir.Version':parse!/1"
      },
      {
        "name": "'Elixir.Version':match?/3"
      },
      {
        "name": "'Elixir.Version':compare/2"
      },
      {
        "name": "'Elixir.Version':parse_requirement/1"
      },
      {
        "name": "'Elixir.Version.Parser':parse_version/2"
      },
      {
        "name": "'Elixir.Version.Parser':parse_digits/2"
      },
      {
        "name": "'Elixir.Version.Parser':require_digits/1"
      },
      {
        "name": "'Elixir.Version.Parser':convert_parts_to_integer/2"
      }
    ]
  }
]
Related CVEs
CVE-2026-49762

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#9041 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement