Elixir 1.20.5, 1.19.7 and 1.18.6 Fix Two Denial-of-Service CVEs in URI.parse and JSON.decode; 1.20.5 Also Fixes a Mix deps.partition Flaw
Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.
Overview
The Elixir project published security releases on October 29 for three supported branches. According to the Elixir 1.20.5 release page, the release was published at 2026-10-29T19:51:12Z and lists three security entries: bounded port handling in URI.parse (CVE-2026-109821), a raised error when JSON decoding integers beyond float64 ranges (CVE-2026-115274), and validation of the deps.partition configuration with a checksum on multi-user systems (CVE-2026-97209). The 1.19.7 and 1.18.6 release pages list the first two entries only.
The URI.parse flaw (CVE-2026-109821)
The CVE record says URI.parse/1 converts the port component with String.to_integer/1 without bounding its length, so a port of up to 1,262,592 decimal digits produces a bignum of that size. It adds that rendering the parsed URI back to text is quadratic on Erlang/OTP 27, 28 and 29.0: a 400,000-digit port renders in about 2.6 seconds and a 1 MB port in about 18 seconds. The record says the issue affects Elixir from 0.5.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5. It lists a CVSS 4.0 base score of 6.3 (Medium).
The record states that on OTP 29.1 and later, rendering a 1 MB port takes under a second. As a workaround, it advises rejecting long URLs before parsing and rejecting a parsed port above 65535; it says URI.new/1 is not affected on Erlang/OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later.
The Erlang/OTP team published a related advisory, GHSA-8qw4-2chm-mvj2, titled “stdlib: Denial-of-Service enabled by Unbounded Integer Conversion” and identified as CVE-2026-59696. It is rated Moderate (6.9) and lists patched OTP versions 29.0.6, 28.5.0.6 and 27.3.4.17. It names uri_string:parse/1 among the affected functions, saying the URL port component has no digit bound.
The JSON.decode flaw (CVE-2026-115274)
According to its CVE record, JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. The record also states that applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
The record gives affected ranges of 1.18.0-rc.0 before 1.18.6, 1.19.0-rc.0 before 1.19.7, and 1.20.0-rc.0 before 1.20.5, and a CVSS 4.0 base score of 6.9 (Medium). Its suggested workaround is a custom integer decoder that rejects long digit runs before conversion; the example in the record rejects literals longer than 1024 bytes and, in Phoenix, passes that module to Plug.Parsers as json_decoder.
The Mix deps.partition flaw (CVE-2026-97209)
The CVE record describes an insecure temporary file in mix deps.partition: partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under the shared system temporary directory, and a local user who created the directory first can replace the file. It says the issue affects mix from 1.20.0-rc.4 before 1.20.5, so the 1.19 and 1.18 branches are not listed. It lists a CVSS 4.0 base score of 5.4 (Medium) with a local attack vector.
The record states the attack requires partitioned compilation, which is off by default and enabled by setting MIX_OS_DEPS_COMPILE_PARTITION_COUNT to a value greater than one. It adds that a shared system temporary directory is the default on Linux when TMPDIR is unset, and that macOS and Windows, with per-user temporary directories by default, are not affected unless TMPDIR points at a shared location. Its workaround is to set TMPDIR to a private per-user directory with mode 0700, or to leave partitioned compilation disabled.
What We Don’t Know
The sources reviewed do not report any exploitation of these flaws in the wild. The release pages do not say which Erlang/OTP releases the Elixir fixes assume, and the Elixir CVE records reference the project’s own GitHub advisories and the Erlang Ecosystem Foundation’s CNA pages, so the severity ratings and attack conditions above are the publisher-side assessment.