{"id":"CVE-2026-49762","revision":null,"records":[{"revision":"2595c5b6a4764dc1b1e1023ae8116591","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49762","aliases":[],"title":"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service","description":"Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects elixir: from 0.9.3 before 1.20.1.","state":0,"publishedAt":"2026-06-09T14:04:07.405+00:00","modifiedAt":"2026-10-06T08:35:59.691+00:00","affected":[{"ecosystem":"Vendor product","name":"elixir","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"cpes\": [\n \"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"\n ],\n \"defaultStatus\": \"unaffected\",\n \"modules\": [\n \"'Elixir.Version'\",\n \"'Elixir.Version.Parser'\"\n ],\n \"packageName\": \"elixir\",\n \"packageURL\": \"pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git\",\n \"product\": \"elixir\",\n \"programFiles\": [\n \"lib/version.ex\"\n ],\n \"programRoutines\": [\n {\n \"name\": \"'Elixir.Version':parse/1\"\n },\n {\n \"name\": \"'Elixir.Version':parse!/1\"\n },\n {\n \"name\": \"'Elixir.Version':match?/3\"\n },\n {\n \"name\": \"'Elixir.Version':compare/2\"\n },\n {\n \"name\": \"'Elixir.Version':parse_requirement/1\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':parse_version/2\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':parse_digits/2\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':require_digits/1\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':convert_parts_to_integer/2\"\n }\n ],\n \"repo\": \"https://github.com/elixir-lang/elixir\",\n \"vendor\": \"elixir-lang\",\n \"versions\": [\n {\n \"lessThan\": \"1.20.1\",\n \"status\": \"affected\",\n \"version\": \"0.9.3\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"https://github.com","name":"elixir-lang/elixir","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"collectionURL\": \"https://github.com\",\n \"cpes\": [\n \"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"\n ],\n \"defaultStatus\": \"unaffected\",\n \"modules\": [\n \"'Elixir.Version'\",\n \"'Elixir.Version.Parser'\"\n ],\n \"packageName\": \"elixir-lang/elixir\",\n \"packageURL\": \"pkg:github/elixir-lang/elixir\",\n \"product\": \"elixir\",\n \"programFiles\": [\n \"lib/elixir/lib/version.ex\"\n ],\n \"programRoutines\": [\n {\n \"name\": \"'Elixir.Version':parse/1\"\n },\n {\n \"name\": \"'Elixir.Version':parse!/1\"\n },\n {\n \"name\": \"'Elixir.Version':match?/3\"\n },\n {\n \"name\": \"'Elixir.Version':compare/2\"\n },\n {\n \"name\": \"'Elixir.Version':parse_requirement/1\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':parse_version/2\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':parse_digits/2\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':require_digits/1\"\n },\n {\n \"name\": \"'Elixir.Version.Parser':convert_parts_to_integer/2\"\n }\n ],\n \"repo\": \"https://github.com/elixir-lang/elixir\",\n \"vendor\": \"elixir-lang\",\n \"versions\": [\n {\n \"changes\": [\n {\n \"at\": \"c64417d72fd5c7d09e963ca3ac5fa2b140978d9e\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"64e6707233464c3e55a9ca6b44019aed25b0390a\",\n \"status\": \"unaffected\"\n }\n ],\n \"lessThan\": \"*\",\n \"status\": \"affected\",\n \"version\": \"057691722eb8cfe315f5606358954a2b173ff7a3\",\n \"versionType\": \"git\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":5.1,"severity":"MEDIUM"}],"references":["https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p","https://cna.erlef.org/cves/CVE-2026-49762.html","https://osv.dev/vulnerability/EEF-CVE-2026-49762","https://github.com/elixir-lang/elixir/commit/057691722eb8cfe315f5606358954a2b173ff7a3","https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e","https://github.com/elixir-lang/elixir/commit/64e6707233464c3e55a9ca6b44019aed25b0390a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49762","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49762","identifiers":["CVE-2026-49762"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T15:59:29.1371819+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T15:59:29.1371819+00:00","lastSuccessAt":"2026-11-11T15:59:29.3319702+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.3319715+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f7a27b6686d027a29d541c1a67c85e77c8818c1542bd9e626ca104d5a08b6cff","complete":true,"records":424160,"lastAttemptAt":"2026-11-11T15:57:33.081355+00:00","lastSuccessAt":"2026-11-11T15:57:32.9249839+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:57:33.081355+00:00","snapshotPublishedAt":"2026-11-11T15:27:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fbe6382b6d1e4810ad598ca4b39b1839","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T16:11:34.900804+00:00","lastSuccessAt":"2026-11-11T16:11:34.895+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T16:11:34.895+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13527,"expectedIdentifiers":13813,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T15:59:29.1371819+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T15:59:29.1371819+00:00","lastSuccessAt":"2026-11-11T15:59:29.3328867+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.332887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-83d5ee721aa54b298ac0e478691d5c53","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T15:59:30.4109764+00:00","lastSuccessAt":"2026-11-11T15:59:30.407+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:30.407+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T15:59:28.9781944+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:28.9781944+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T15:57:33.229994+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:57:33.229994+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T15:59:29.0795742+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.0795742+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-eb69eb75f2b568fd8be458efa2db8e11aac201724ba0b44fa3f79c386f195e15","complete":true,"records":231668,"lastAttemptAt":"2026-11-11T15:59:28.847182+00:00","lastSuccessAt":"2026-11-11T15:59:27.3458308+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:28.847182+00:00","snapshotPublishedAt":"2026-11-11T15:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}