CVE-2026-109821 Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.tointeger/1 in splitauthority/1...

CVE-2026-109821

The Elixir standard library's URI module contains an Improper Validation of Specified Quantity in Input vulnerability in URI.parse/1. The split_authority/1 function converts the port component using String.to_integer/1 without bounding its length. This allows an attacker to provide a URL with a p...

EUVD-2026-113757

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.tointeger/1 in splitauthority/1...