- Yama var
- Son 7 gün
- CWE-1284
CVE-2026-115274
Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir
- Yayımlandı
- Güncellendi
- 30 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- EEF
Özet
Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.
Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion.
JSON.decode/1 and JSON.decode!/1 convert each integer literal with erlang:binary_to_integer/1 and do not bound its length. A literal of one million digits decodes successfully but costs 100 to 300 times as much CPU as a string of the same length, so one request body of a few megabytes holds a scheduler for about a second. A literal of more than about 1.29 million digits raises SystemLimitError. Applications generated by phx.new decode request bodies with JSON in Plug.Parsers, before routing and authentication.
This issue affects elixir: from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| elixir-lang elixir | ≥ 1.18.0-rc.0, < 1.18.6 | 1.18.6 |
| ≥ 1.19.0-rc.0, < 1.19.7 | 1.19.7 | |
| ≥ 1.20.0-rc.0, < 1.20.5 | 1.20.5 |
Kaynaklar10 kaynak
- CVE.org kaydı
- NVD kaydı
- github.com/…elixir/security/advisories/GHSA-rp5q-xqhq-926h Üretici bülteni
- github.com/…ommit/c81f12265919c34a0d5134f1905a4eb4edaea1c2 Yama
- github.com/…ommit/7154e8781da9fd016a973ea01776a011c8b5726a Yama
- github.com/…ommit/cd158efacdc10b30232864251747dff9b8387dfe Yama
- github.com/…ommit/ee5cc23f8928aa5a0f25bb7f28e42ecfc7b7d396 Yama
- cna.erlef.org/cves/CVE-2026-115274.html Diğer
- osv.dev/vulnerability/EEF-CVE-2026-115274 Diğer
- github.com/…ommit/793c1147210388587defb649f25f293ffbfa6b1b Diğer
Kayıt geçmişi
- Yayımlandı