CVE-2026-115274

Full vulnerability record from the local CVENow database.

Description

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication. This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.

Severity

MEDIUM

CVSS score

6.9 (v4.0)

Vulnerability status

Received

Source identifier

6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Published

2026-10-30 09:17:14.103000

Last modified

2026-10-30 09:17:14.103000

View original CVE JSON

{
  "id": "CVE-2026-115274",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-10-30T09:17:14.103",
  "lastModified": "2026-10-30T09:17:14.103",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.\n\nJSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.\n\nThis issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "elixir-lang",
          "product": "elixir",
          "defaultStatus": "unaffected",
          "packageName": "elixir",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.JSON'",
            "elixir_json"
          ],
          "programFiles": [
            "lib/json.ex",
            "src/elixir_json.erl"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.JSON':decode/1"
            },
            {
              "name": "'Elixir.JSON':'decode!'/1"
            },
            {
              "name": "'Elixir.JSON':decode/3"
            },
            {
              "name": "elixir_json:decode/3"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
          "versions": [
            {
              "version": "1.18.0-rc.0",
              "lessThan": "1.18.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.19.0-rc.0",
              "lessThan": "1.19.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.20.0-rc.0",
              "lessThan": "1.20.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "elixir-lang",
          "product": "elixir",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "elixir-lang/elixir",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.JSON'",
            "elixir_json"
          ],
          "programFiles": [
            "lib/elixir/lib/json.ex",
            "lib/elixir/src/elixir_json.erl"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.JSON':decode/1"
            },
            {
              "name": "'Elixir.JSON':'decode!'/1"
            },
            {
              "name": "'Elixir.JSON':decode/3"
            },
            {
              "name": "elixir_json:decode/3"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "packageURL": "pkg:github/elixir-lang/elixir",
          "versions": [
            {
              "version": "793c1147210388587defb649f25f293ffbfa6b1b",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "c81f12265919c34a0d5134f1905a4eb4edaea1c2",
                  "status": "unaffected"
                },
                {
                  "at": "7154e8781da9fd016a973ea01776a011c8b5726a",
                  "status": "unaffected"
                },
                {
                  "at": "cd158efacdc10b30232864251747dff9b8387dfe",
                  "status": "unaffected"
                },
                {
                  "at": "ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-115274.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/commit/7154e8781da9fd016a973ea01776a011c8b5726a",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/commit/793c1147210388587defb649f25f293ffbfa6b1b",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/commit/c81f12265919c34a0d5134f1905a4eb4edaea1c2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/commit/cd158efacdc10b30232864251747dff9b8387dfe",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/commit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-rp5q-xqhq-926h",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-115274",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}