Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.18.6, 1.19.7, 1.20.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The Elixir standard library's JSON module, specifically the JSON.decode/1 and JSON.decode!/1 functions, is affected. An unauthenticated attacker who sends a JSON document with an extremely long integer can exhaust CPU and memory on the server, causing a denial of service; this includes Phoenix applications generated with phx.new, which decode request bodies before routing and authentication.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- elixir
From 1.18.0-rc.0 · fixed in 1.18.6; From 1.19.0-rc.0 · fixed in 1.19.7; From 1.20.0-rc.0 · fixed in 1.20.5
- elixir-lang/elixir
Version range not reported