CVE-2026-49762 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

[
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Version'",
      "'Elixir.Version.Parser'"
    ],
    "packageName": "elixir-lang/elixir",
    "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
    "product": "elixir",
    "programFiles": [
      "lib/version.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Version':parse/1"
      },
      {
        "name": "'Elixir.Version':parse!/1"
      },
      {
        "name": "'Elixir.Version':match?/3"
      },
      {
        "name": "'Elixir.Version':compare/2"
      },
      {
        "name": "'Elixir.Version':parse_requirement/1"
      },
      {
        "name": "'Elixir.Version.Parser':parse_version/2"
      },
      {
        "name": "'Elixir.Version.Parser':parse_digits/2"
      },
      {
        "name": "'Elixir.Version.Parser':require_digits/1"
      },
      {
        "name": "'Elixir.Version.Parser':convert_parts_to_integer/2"
      }
    ],
    "repo": "https://github.com/elixir-lang/elixir",
    "vendor": "elixir-lang",
    "versions": [
      {
        "lessThan": "1.20.1",
        "status": "affected",
        "version": "1.5.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Version'",
      "'Elixir.Version.Parser'"
    ],
    "packageName": "elixir-lang/elixir",
    "packageURL": "pkg:github/elixir-lang/elixir",
    "product": "elixir",
    "programFiles": [
      "lib/elixir/lib/version.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Version':parse/1"
      },
      {
        "name": "'Elixir.Version':parse!/1"
      },
      {
        "name": "'Elixir.Version':match?/3"
      },
      {
        "name": "'Elixir.Version':compare/2"
      },
      {
        "name": "'Elixir.Version':parse_requirement/1"
      },
      {
        "name": "'Elixir.Version.Parser':parse_version/2"
      },
      {
        "name": "'Elixir.Version.Parser':parse_digits/2"
      },
      {
        "name": "'Elixir.Version.Parser':require_digits/1"
      },
      {
        "name": "'Elixir.Version.Parser':convert_parts_to_integer/2"
      }
    ],
    "repo": "https://github.com/elixir-lang/elixir.git",
    "vendor": "elixir-lang",
    "versions": [
      {
        "lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
        "status": "affected",
        "version": "63e186aea94395897dc4964d82d250130c01ec25",
        "versionType": "git"
      }
    ]
  }
]