CVE-2026-109821
Description
A flaw was found in Elixir. This vulnerability allows an attacker to cause a Denial of Service (DoS) through CPU exhaustion by providing a Uniform Resource Identifier (URI) containing an excessively long port number. Because the URI parser does not properly validate or bound the length of the port component, converting the oversized number back into text requires substantial computation time. Consequently, common operations such as logging or error formatting on affected inputs can monopolize system resources and render the application unresponsive.
Statement
This vulnerability is rated with a Moderate impact because exploitation causes temporary CPU resource exhaustion without enabling remote code execution or unauthorized access to sensitive data. Within Red Hat environments, risk is restricted to services that parse and subsequently serialize externally supplied uniform resource identifiers without prior size filtering. The blast radius remains limited to the affected application process, and widespread disruption requires sustained delivery of malicious input.
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
