CVE-2026-49762
Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service
Description
Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects Elixir: from 1.5.0 before 1.20.1.
INFO
Published Date :
June 9, 2026, 2:16 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
No
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Elixir to version 1.20.1 or later.
- Validate version strings before parsing.
- Limit the length of version components.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-49762.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-49762 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-49762
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49762 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-49762 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: elixir de elixir-lang, Description: Una vulnerabilidad de Consumo de Recursos No Controlado en el módulo Version de la biblioteca estándar de Elixir permite a un atacante que controla una cadena de versión causar una denegación de servicio a través del agotamiento de CPU y memoria. El analizador de versiones convierte componentes numéricos de versión (mayor, menor, parche e identificadores numéricos de pre-lanzamiento/construcción) a enteros sin limitar su longitud. Un único componente grande de solo dígitos, por lo tanto, fuerza una conversión superlineal, no productiva, de base-10 a entero de precisión arbitraria (String.to_integer/1, es decir, :erlang.binary_to_integer/1) que fija un planificador BEAM, y un componente más grande genera un SystemLimitError no capturado que bloquea el proceso de llamada. Una única cadena de tamaño moderado (alrededor de un megabyte) es suficiente; no se requiere autenticación. Esto es accesible desde los puntos de entrada públicos Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, y Version.parse_requirement/1, que las aplicaciones llaman rutinariamente en entradas no confiables como parámetros HTTP, campos de manifiesto de dependencia y metadatos de paquete. Esta vulnerabilidad está asociada con los archivos de programa lib/version.ex y las rutinas de programa 'Elixir.Version.Parser':parse_digits/2. Este problema afecta a Elixir: desde 1.5.0 antes de 1.20.1. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-lang/elixir', 'vendor': 'elixir-lang', 'modules': ["'Elixir.Version'", "'Elixir.Version.Parser'"], 'product': 'elixir', 'versions': [{'status': 'affected', 'version': '1.5.0', 'lessThan': '1.20.1', 'versionType': 'semver'}], 'packageURL': 'pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git', 'packageName': 'elixir-lang/elixir', 'programFiles': ['lib/version.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Version':parse/1"}, {'name': "'Elixir.Version':parse!/1"}, {'name': "'Elixir.Version':match?/3"}, {'name': "'Elixir.Version':compare/2"}, {'name': "'Elixir.Version':parse_requirement/1"}, {'name': "'Elixir.Version.Parser':parse_version/2"}, {'name': "'Elixir.Version.Parser':parse_digits/2"}, {'name': "'Elixir.Version.Parser':require_digits/1"}, {'name': "'Elixir.Version.Parser':convert_parts_to_integer/2"}]}, {'cpes': ['cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-lang/elixir.git', 'vendor': 'elixir-lang', 'modules': ["'Elixir.Version'", "'Elixir.Version.Parser'"], 'product': 'elixir', 'versions': [{'status': 'affected', 'version': '63e186aea94395897dc4964d82d250130c01ec25', 'lessThan': 'c64417d72fd5c7d09e963ca3ac5fa2b140978d9e', 'versionType': 'git'}], 'packageURL': 'pkg:github/elixir-lang/elixir', 'packageName': 'elixir-lang/elixir', 'programFiles': ['lib/elixir/lib/version.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Version':parse/1"}, {'name': "'Elixir.Version':parse!/1"}, {'name': "'Elixir.Version':match?/3"}, {'name': "'Elixir.Version':compare/2"}, {'name': "'Elixir.Version':parse_requirement/1"}, {'name': "'Elixir.Version.Parser':parse_version/2"}, {'name': "'Elixir.Version.Parser':parse_digits/2"}, {'name': "'Elixir.Version.Parser':require_digits/1"}, {'name': "'Elixir.Version.Parser':convert_parts_to_integer/2"}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-49762', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-09T14:48:56.343391Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 09, 2026
Action Type Old Value New Value Added Description Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects Elixir: from 1.5.0 before 1.20.1. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-400 Added Reference https://cna.erlef.org/cves/CVE-2026-49762.html Added Reference https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e Added Reference https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-49762