CVE-2026-49762

{"id": "CVE-2026-49762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:48:56.343391Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-lang/elixir", "vendor": "elixir-lang", "modules": ["'Elixir.Version'", "'Elixir.Version.Parser'"], "product": "elixir", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.20.1", "versionType": "semver"}], "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir&vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git", "packageName": "elixir-lang/elixir", "programFiles": ["lib/version.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Version':parse/1"}, {"name": "'Elixir.Version':parse!/1"}, {"name": "'Elixir.Version':match?/3"}, {"name": "'Elixir.Version':compare/2"}, {"name": "'Elixir.Version':parse_requirement/1"}, {"name": "'Elixir.Version.Parser':parse_version/2"}, {"name": "'Elixir.Version.Parser':parse_digits/2"}, {"name": "'Elixir.Version.Parser':require_digits/1"}, {"name": "'Elixir.Version.Parser':convert_parts_to_integer/2"}]}, {"cpes": ["cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-lang/elixir.git", "vendor": "elixir-lang", "modules": ["'Elixir.Version'", "'Elixir.Version.Parser'"], "product": "elixir", "versions": [{"status": "affected", "version": "63e186aea94395897dc4964d82d250130c01ec25", "lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e", "versionType": "git"}], "packageURL": "pkg:github/elixir-lang/elixir", "packageName": "elixir-lang/elixir", "programFiles": ["lib/elixir/lib/version.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Version':parse/1"}, {"name": "'Elixir.Version':parse!/1"}, {"name": "'Elixir.Version':match?/3"}, {"name": "'Elixir.Version':compare/2"}, {"name": "'Elixir.Version':parse_requirement/1"}, {"name": "'Elixir.Version.Parser':parse_version/2"}, {"name": "'Elixir.Version.Parser':parse_digits/2"}, {"name": "'Elixir.Version.Parser':require_digits/1"}, {"name": "'Elixir.Version.Parser':convert_parts_to_integer/2"}]}]}], "published": "2026-06-09T14:16:44.317", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-49762.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1."}, {"lang": "es", "value": "Una vulnerabilidad de Consumo de Recursos No Controlado en el m\u00f3dulo Version de la biblioteca est\u00e1ndar de Elixir permite a un atacante que controla una cadena de versi\u00f3n causar una denegaci\u00f3n de servicio a trav\u00e9s del agotamiento de CPU y memoria.\n\nEl analizador de versiones convierte componentes num\u00e9ricos de versi\u00f3n (mayor, menor, parche e identificadores num\u00e9ricos de pre-lanzamiento/construcci\u00f3n) a enteros sin limitar su longitud. Un \u00fanico componente grande de solo d\u00edgitos, por lo tanto, fuerza una conversi\u00f3n superlineal, no productiva, de base-10 a entero de precisi\u00f3n arbitraria (String.to_integer/1, es decir, :erlang.binary_to_integer/1) que fija un planificador BEAM, y un componente m\u00e1s grande genera un SystemLimitError no capturado que bloquea el proceso de llamada. Una \u00fanica cadena de tama\u00f1o moderado (alrededor de un megabyte) es suficiente; no se requiere autenticaci\u00f3n.\n\nEsto es accesible desde los puntos de entrada p\u00fablicos Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, y Version.parse_requirement/1, que las aplicaciones llaman rutinariamente en entradas no confiables como par\u00e1metros HTTP, campos de manifiesto de dependencia y metadatos de paquete.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/version.ex y las rutinas de programa 'Elixir.Version.Parser':parse_digits/2.\n\nEste problema afecta a Elixir: desde 1.5.0 antes de 1.20.1."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}