{"id":"AZL-111661","summary":"CVE-2026-109821 affecting package elixir 1.16.1-3","details":"Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion.\n\nURI.parse/1 converts the port component with String.to_integer/1 in split_authority/1 (lib/elixir/lib/uri.ex) without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size and a longer one raises SystemLimitError. Rendering the parsed URI back to text (URI.to_string/1, inspect/1, logging, error formatting) converts the bignum with :erlang.integer_to_binary/1, which is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. Ports above 65535 are also accepted.\n\nThis issue affects elixir: from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.","modified":"2026-10-31T14:17:29.990555719Z","published":"2026-10-30T09:17:12Z","upstream":["CVE-2026-109821"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109821"}],"affected":[{"package":{"name":"elixir","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/elixir"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.16.1-3"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111661.json"}}],"schema_version":"1.9.2"}