Input Validation Flaw in Elixir URI Module Causes Denial of Service

CVE-2026-109821

What is CVE-2026-109821?

The Elixir standard library's URI module suffers from an improper input validation vulnerability, allowing an attacker to manipulate the port component of a URL. This flaw can lead to a denial of service through CPU exhaustion, as the parsing of excessively long port values causes significant performance degradation. Specifically, when excessively long ports—potentially exceeding 1,262,592 digits—are rendered back to text, they can lead to lengthy processing times, potentially freezing the application. Affected versions include those from 0.5.0 before 1.18.6 and from 1.19.0-rc.0 before 1.19.7, highlighting the need for immediate patching to mitigate risks.

References