Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-49762
elixir-lang elixir — Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
L L N N N N N L 5.1 .0022 11.4 —
AFFECTED
Product Versions Fixed
elixir 0.9.3 – —
elixir 057691722eb8cfe315f5606358954a2b173ff7a3 – c64417d72fd5c7d09e963ca3ac5fa2b140978d9e
TIMELINE
Jun 1 Reserved by EEF
Jun 9 Published (CNA: EEF)
Oct 5 PATCH SHIPPED — CVE-2026-49762 (elixir-lang elixir). Fixed in elixir c64417d72fd5c7d09e963ca3ac5fa2b140978d9e.
Description
Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.
The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.
This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.
This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2.
This issue affects elixir: from 0.9.3 before 1.20.1.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 1, 2026 | Reserved | Reserved by EEF |
| June 9, 2026 | Published | Published (CNA: EEF) |
| October 5, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-49762 (elixir-lang elixir). Fixed in elixir c64417d72fd5c7d09e963ca3ac5fa2b140978d9e. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| elixir-lang | elixir | — | 0.9.3 | — |
| elixir-lang | elixir | — | 057691722eb8cfe315f5606358954a2b173ff7a3 | c64417d72fd5c7d09e963ca3ac5fa2b140978d9e |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49762 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
