Resource Exhaustion Vulnerability in Elixir's Version Module

CVE-2026-49762

What is CVE-2026-49762?

An uncontrolled resource consumption vulnerability exists in the Elixir standard library's Version module, allowing an attacker to manipulate version strings for denial of service attacks. When the version parser processes large numeric components without length limitations, it leads to excessive CPU and memory usage, causing a BEAM scheduler pin and potentially crashing the calling process. This vulnerability can be triggered through common public entry points that accept untrusted input, making it particularly critical for applications handling HTTP parameters and package metadata.

References