Elixir URI module flaw enables CPU-exhaustion denial of service (EUVD-2026-113757)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- elixir-lang
- Product
- Elixir standard library (URI module)
- First seen
Summary
The EUVD entry, scored 6.3/10 (CVSS v3.1), describes improper input validation in Elixir's standard library URI module. The item says an attacker who supplies a URL can exhaust CPU through URI.parse/1.
If you use elixir-lang
Update Elixir to a release that includes the fix for the URI module.
Limit the length and source of URLs passed to URI.parse/1 until patched.
Monitor services that parse user-supplied URLs for CPU spikes.
Update Elixir to a release that includes the fix for the JSON module.
Limit the size of JSON payloads accepted from untrusted sources until patched.
Monitor services that decode untrusted JSON for CPU and memory spikes.
What the sources say 2
· Mastodon: “Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory e...” Source
· Mastodon: “Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.” Source