Input Validation Flaw in Elixir JSON Module Allows Denial of Service

CVE-2026-115274

What is CVE-2026-115274?

The Elixir standard library's JSON module suffers from a significant input validation issue, allowing unbounded integer parsing. When processing JSON documents, attackers can exploit this vulnerability by supplying excessively large integer literals. This can lead to a denial of service due to CPU and memory exhaustion, where a request made with extensive integer inputs can monopolize system resources for an extended period. Affected versions do not impose limits on input sizes, enabling the possibility of overwhelming applications that utilize JSON in their request handling process. Ensure your Elixir installations are updated to the latest versions to mitigate this risk.

References