CVE-2026-115274 in Elixir
Summary
by MITRE • 10/30/2026
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as Improper Validation of Specified Quantity in Input within the Elixir standard library's JSON module represents a significant risk to application availability through resource exhaustion attacks. This flaw specifically impacts the JSON.decode and JSON.decode!/1 functions, which are responsible for parsing incoming JSON documents into Erlang terms. The core technical deficiency lies in how these functions handle integer literals during conversion via erlang:binary_to_integer/1. Unlike string decoding processes that may have inherent length limits or efficient memory management strategies, the integer parsing logic does not impose a bound on the number of digits allowed within an integer literal. This lack of validation allows attackers to craft JSON payloads containing integers with exceptionally large digit counts, such as literals exceeding one million digits, which are processed without triggering immediate rejection mechanisms for size alone.
The operational impact of this vulnerability is severe due to the disproportionate computational cost associated with parsing extremely long integer strings. When a JSON document contains an integer literal of substantial length, the CPU and memory resources required to decode it increase exponentially relative to standard inputs. Specifically, processing a one-million-digit integer can consume between 100 to 300 times more CPU cycles than decoding a string of equivalent byte length. This inefficiency means that even relatively small request bodies, potentially only a few megabytes in size, are sufficient to monopolize an Erlang scheduler for approximately one second. In high-throughput environments or under sustained attack conditions, this resource consumption can lead to complete system unresponsiveness, effectively causing a denial of service by exhausting available computational resources and preventing legitimate requests from being processed.
The risk is further amplified in typical web application architectures generated using the Phoenix framework via phx.new. These applications commonly utilize Plug.Parsers to decode request bodies containing JSON data before routing decisions are made or authentication checks are performed. Because this parsing occurs early in the request lifecycle, an attacker can trigger resource exhaustion without needing valid credentials or bypassing any access controls. The system processes the malicious payload during the initial input validation phase, meaning that unauthenticated actors can exploit this flaw directly against public-facing endpoints. If a literal exceeds approximately 1.29 million digits, the process may raise a SystemLimitError, which could potentially be leveraged to crash individual nodes or cause instability within the BEAM virtual machine cluster if not handled gracefully by the application layer.
This vulnerability affects multiple versions of the Elixir language and its standard library distribution. Specifically, it impacts releases from 1.18.0-rc.0 up to but excluding version 1.18.6, versions from 1.19.0-rc.0 before 1.19.7, and versions from 1.20.0-rc.0 prior to 1.20.5. Organizations running these affected versions are advised to upgrade immediately to the patched releases where appropriate bounds checking has been implemented for integer literals in JSON decoding functions. Mitigation strategies also include implementing strict input size limits at the web server or reverse proxy level before requests reach the Elixir application, as well as configuring Plug.Parsers with explicit length constraints on request bodies. Additionally, developers should consider using alternative JSON libraries that enforce stricter parsing rules if upgrading is not immediately feasible, though patching to a supported version remains the primary and most effective remediation path. This issue aligns with CWE-20 Improper Input Validation and can be categorized under ATT&CK techniques related to Resource Exhaustion Attacks, highlighting the critical need for robust input sanitization in all data processing pipelines.