Vulnerability-Lookup

CVE-2026-49762 (GCVE-0-2026-49762)

Vulnerability from cvelistv5 – Published: 2026-06-09 14:04 – Updated: 2026-06-10 04:43

Title

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Summary

Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects Elixir: from 1.5.0 before 1.20.1.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

EEF

References

4 references

URL	Tags
https://github.com/elixir-lang/elixir/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-49762.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-49762	related
https://github.com/elixir-lang/elixir/commit/c644…	patch

Impacted products

2 products

Vendor	Product	Version
elixir-lang	elixir	Affected: 1.5.0 , < 1.20.1 (semver) cpe:2.3:a:elixir-lang:elixir::::::::
elixir-lang	elixir	Affected: 63e186aea94395897dc4964d82d250130c01ec25 , < c64417d72fd5c7d09e963ca3ac5fa2b140978d9e (git) cpe:2.3:a:elixir-lang:elixir::::::::

Credits

Peter Ullrich José Valim Eric Meadows-Jönsson Jonatan Männchen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:48:56.343391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:49:07.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Version\u0027",
            "\u0027Elixir.Version.Parser\u0027"
          ],
          "packageName": "elixir-lang/elixir",
          "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
          "product": "elixir",
          "programFiles": [
            "lib/version.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Version\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse!/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:match?/3"
            },
            {
              "name": "\u0027Elixir.Version\u0027:compare/2"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse_requirement/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "vendor": "elixir-lang",
          "versions": [
            {
              "lessThan": "1.20.1",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Version\u0027",
            "\u0027Elixir.Version.Parser\u0027"
          ],
          "packageName": "elixir-lang/elixir",
          "packageURL": "pkg:github/elixir-lang/elixir",
          "product": "elixir",
          "programFiles": [
            "lib/elixir/lib/version.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Version\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse!/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:match?/3"
            },
            {
              "name": "\u0027Elixir.Version\u0027:compare/2"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse_requirement/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir.git",
          "vendor": "elixir-lang",
          "versions": [
            {
              "lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
              "status": "affected",
              "version": "63e186aea94395897dc4964d82d250130c01ec25",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.20.1",
                  "versionStartIncluding": "1.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s \u003ctt\u003eVersion\u003c/tt\u003e module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\u003c/p\u003e\u003cp\u003eThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (\u003ctt\u003eString.to_integer/1\u003c/tt\u003e, i.e. \u003ctt\u003e:erlang.binary_to_integer/1\u003c/tt\u003e) that pins a BEAM scheduler, and a larger component raises an uncaught \u003ctt\u003eSystemLimitError\u003c/tt\u003e that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\u003c/p\u003e\u003cp\u003eThis is reachable from the public entry points \u003ctt\u003eVersion.parse/1\u003c/tt\u003e, \u003ctt\u003eVersion.parse!/1\u003c/tt\u003e, \u003ctt\u003eVersion.match?/3\u003c/tt\u003e, \u003ctt\u003eVersion.compare/2\u003c/tt\u003e, and \u003ctt\u003eVersion.parse_requirement/1\u003c/tt\u003e, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/version.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Version.Parser\u0027:parse_digits/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Elixir: from 1.5.0 before 1.20.1.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T04:43:08.517Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-49762.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-49762",
    "datePublished": "2026-06-09T14:04:07.405Z",
    "dateReserved": "2026-06-01T13:45:22.449Z",
    "dateUpdated": "2026-06-10T04:43:08.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49762",
      "date": "2026-07-27",
      "epss": "0.00152",
      "percentile": "0.04858"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:58:48.000Z",
      "cve": "CVE-2026-49762",
      "id": "msrc_CVE-2026-49762",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-49762.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49762\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-06-09T14:16:44.317\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\\n\\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\\n\\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\\n\\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\\n\\nThis issue affects Elixir: from 1.5.0 before 1.20.1.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de Consumo de Recursos No Controlado en el m\u00f3dulo Version de la biblioteca est\u00e1ndar de Elixir permite a un atacante que controla una cadena de versi\u00f3n causar una denegaci\u00f3n de servicio a trav\u00e9s del agotamiento de CPU y memoria.\\n\\nEl analizador de versiones convierte componentes num\u00e9ricos de versi\u00f3n (mayor, menor, parche e identificadores num\u00e9ricos de pre-lanzamiento/construcci\u00f3n) a enteros sin limitar su longitud. Un \u00fanico componente grande de solo d\u00edgitos, por lo tanto, fuerza una conversi\u00f3n superlineal, no productiva, de base-10 a entero de precisi\u00f3n arbitraria (String.to_integer/1, es decir, :erlang.binary_to_integer/1) que fija un planificador BEAM, y un componente m\u00e1s grande genera un SystemLimitError no capturado que bloquea el proceso de llamada. Una \u00fanica cadena de tama\u00f1o moderado (alrededor de un megabyte) es suficiente; no se requiere autenticaci\u00f3n.\\n\\nEsto es accesible desde los puntos de entrada p\u00fablicos Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, y Version.parse_requirement/1, que las aplicaciones llaman rutinariamente en entradas no confiables como par\u00e1metros HTTP, campos de manifiesto de dependencia y metadatos de paquete.\\n\\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/version.ex y las rutinas de programa \u0027Elixir.Version.Parser\u0027:parse_digits/2.\\n\\nEste problema afecta a Elixir: desde 1.5.0 antes de 1.20.1.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"elixir-lang\",\"product\":\"elixir\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"elixir-lang/elixir\",\"cpes\":[\"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Version\u0027\",\"\u0027Elixir.Version.Parser\u0027\"],\"programFiles\":[\"lib/version.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Version\u0027:parse/1\"},{\"name\":\"\u0027Elixir.Version\u0027:parse!/1\"},{\"name\":\"\u0027Elixir.Version\u0027:match?/3\"},{\"name\":\"\u0027Elixir.Version\u0027:compare/2\"},{\"name\":\"\u0027Elixir.Version\u0027:parse_requirement/1\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:parse_version/2\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:parse_digits/2\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:require_digits/1\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2\"}],\"repo\":\"https://github.com/elixir-lang/elixir\",\"packageURL\":\"pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git\",\"versions\":[{\"version\":\"1.5.0\",\"lessThan\":\"1.20.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"elixir-lang\",\"product\":\"elixir\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"elixir-lang/elixir\",\"cpes\":[\"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Version\u0027\",\"\u0027Elixir.Version.Parser\u0027\"],\"programFiles\":[\"lib/elixir/lib/version.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Version\u0027:parse/1\"},{\"name\":\"\u0027Elixir.Version\u0027:parse!/1\"},{\"name\":\"\u0027Elixir.Version\u0027:match?/3\"},{\"name\":\"\u0027Elixir.Version\u0027:compare/2\"},{\"name\":\"\u0027Elixir.Version\u0027:parse_requirement/1\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:parse_version/2\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:parse_digits/2\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:require_digits/1\"},{\"name\":\"\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2\"}],\"repo\":\"https://github.com/elixir-lang/elixir.git\",\"packageURL\":\"pkg:github/elixir-lang/elixir\",\"versions\":[{\"version\":\"63e186aea94395897dc4964d82d250130c01ec25\",\"lessThan\":\"c64417d72fd5c7d09e963ca3ac5fa2b140978d9e\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-09T14:48:56.343391Z\",\"id\":\"CVE-2026-49762\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-49762.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-49762\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:43:12+00:00",
      "cve": "CVE-2026-49762",
      "id": "CVE-2026-49762",
      "initial_release_date": "2026-06-09T14:04:07.405000+00:00",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "elixir: Elixir Version module: Denial of Service via uncontrolled resource consumption with crafted version string",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49762.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-10T02:25:21Z",
      "cve": "CVE-2026-49762",
      "id": "CVE-2026-49762",
      "initial_release_date": "2026-06-10T02:25:21Z",
      "product_status:known_affected": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-49762",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-49762.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-09T14:48:56.343391Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-09T14:49:00.483Z\"}}], \"cna\": {\"title\": \"Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jos\\u00e9 Valim\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-lang/elixir\", \"vendor\": \"elixir-lang\", \"modules\": [\"\u0027Elixir.Version\u0027\", \"\u0027Elixir.Version.Parser\u0027\"], \"product\": \"elixir\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.20.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git\", \"packageName\": \"elixir-lang/elixir\", \"programFiles\": [\"lib/version.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Version\u0027:parse/1\"}, {\"name\": \"\u0027Elixir.Version\u0027:parse!/1\"}, {\"name\": \"\u0027Elixir.Version\u0027:match?/3\"}, {\"name\": \"\u0027Elixir.Version\u0027:compare/2\"}, {\"name\": \"\u0027Elixir.Version\u0027:parse_requirement/1\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:parse_version/2\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:parse_digits/2\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:require_digits/1\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2\"}]}, {\"cpes\": [\"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-lang/elixir.git\", \"vendor\": \"elixir-lang\", \"modules\": [\"\u0027Elixir.Version\u0027\", \"\u0027Elixir.Version.Parser\u0027\"], \"product\": \"elixir\", \"versions\": [{\"status\": \"affected\", \"version\": \"63e186aea94395897dc4964d82d250130c01ec25\", \"lessThan\": \"c64417d72fd5c7d09e963ca3ac5fa2b140978d9e\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/elixir-lang/elixir\", \"packageName\": \"elixir-lang/elixir\", \"programFiles\": [\"lib/elixir/lib/version.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Version\u0027:parse/1\"}, {\"name\": \"\u0027Elixir.Version\u0027:parse!/1\"}, {\"name\": \"\u0027Elixir.Version\u0027:match?/3\"}, {\"name\": \"\u0027Elixir.Version\u0027:compare/2\"}, {\"name\": \"\u0027Elixir.Version\u0027:parse_requirement/1\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:parse_version/2\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:parse_digits/2\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:require_digits/1\"}, {\"name\": \"\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2\"}]}], \"references\": [{\"url\": \"https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-49762.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-49762\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\\n\\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\\n\\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\\n\\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\\n\\nThis issue affects Elixir: from 1.5.0 before 1.20.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s \u003ctt\u003eVersion\u003c/tt\u003e module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\u003c/p\u003e\u003cp\u003eThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (\u003ctt\u003eString.to_integer/1\u003c/tt\u003e, i.e. \u003ctt\u003e:erlang.binary_to_integer/1\u003c/tt\u003e) that pins a BEAM scheduler, and a larger component raises an uncaught \u003ctt\u003eSystemLimitError\u003c/tt\u003e that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\u003c/p\u003e\u003cp\u003eThis is reachable from the public entry points \u003ctt\u003eVersion.parse/1\u003c/tt\u003e, \u003ctt\u003eVersion.parse!/1\u003c/tt\u003e, \u003ctt\u003eVersion.match?/3\u003c/tt\u003e, \u003ctt\u003eVersion.compare/2\u003c/tt\u003e, and \u003ctt\u003eVersion.parse_requirement/1\u003c/tt\u003e, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/version.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Version.Parser\u0027:parse_digits/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Elixir: from 1.5.0 before 1.20.1.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.20.1\", \"versionStartIncluding\": \"1.5.0\"}], \"operator\": \"AND\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-06-10T04:43:08.517Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T04:43:08.517Z\", \"dateReserved\": \"2026-06-01T13:45:22.449Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-06-09T14:04:07.405Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0753

Vulnerability from certfr_avis - Published: 2026-06-15 - Updated: 2026-06-15

De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	N/A	azl3 sqlite 3.44.0-3 versions antérieures à 3.44.0-4
Microsoft	N/A	azl3 elixir 1.16.1-1 versions antérieures à 1.16.1-2
Microsoft	N/A	azl3 ldns 1.8.3-2 versions antérieures à 1.8.3-3
Microsoft	N/A	azl3 rust 1.75.0-29 versions antérieures à 1.75.0-30
Microsoft	N/A	azl3 lldpd 1.0.17-2 versions antérieures à 1.0.22-1
Microsoft	N/A	azl3 python3 3.12.9-11 versions antérieures à 3.12.9-13
Microsoft	N/A	azl3 rust 1.90.0-8 versions antérieures à 1.90.0-9
Microsoft	N/A	azl3 vim 9.2.0488-1 versions antérieures à 9.2.0620-1

References

Title

Publication Time

FKIE_CVE-2026-49762

Vulnerability from fkie_nvd - Published: 2026-06-09 14:16 - Updated: 2026-07-23 08:10

Severity

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-49762.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-49762

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Version\u0027",
            "\u0027Elixir.Version.Parser\u0027"
          ],
          "packageName": "elixir-lang/elixir",
          "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
          "product": "elixir",
          "programFiles": [
            "lib/version.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Version\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse!/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:match?/3"
            },
            {
              "name": "\u0027Elixir.Version\u0027:compare/2"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse_requirement/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "vendor": "elixir-lang",
          "versions": [
            {
              "lessThan": "1.20.1",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Version\u0027",
            "\u0027Elixir.Version.Parser\u0027"
          ],
          "packageName": "elixir-lang/elixir",
          "packageURL": "pkg:github/elixir-lang/elixir",
          "product": "elixir",
          "programFiles": [
            "lib/elixir/lib/version.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Version\u0027:parse/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse!/1"
            },
            {
              "name": "\u0027Elixir.Version\u0027:match?/3"
            },
            {
              "name": "\u0027Elixir.Version\u0027:compare/2"
            },
            {
              "name": "\u0027Elixir.Version\u0027:parse_requirement/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_version/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:parse_digits/2"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:require_digits/1"
            },
            {
              "name": "\u0027Elixir.Version.Parser\u0027:convert_parts_to_integer/2"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir.git",
          "vendor": "elixir-lang",
          "versions": [
            {
              "lessThan": "c64417d72fd5c7d09e963ca3ac5fa2b140978d9e",
              "status": "affected",
              "version": "63e186aea94395897dc4964d82d250130c01ec25",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion.\n\nThe version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required.\n\nThis is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata.\n\nThis vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2.\n\nThis issue affects Elixir: from 1.5.0 before 1.20.1."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Consumo de Recursos No Controlado en el m\u00f3dulo Version de la biblioteca est\u00e1ndar de Elixir permite a un atacante que controla una cadena de versi\u00f3n causar una denegaci\u00f3n de servicio a trav\u00e9s del agotamiento de CPU y memoria.\n\nEl analizador de versiones convierte componentes num\u00e9ricos de versi\u00f3n (mayor, menor, parche e identificadores num\u00e9ricos de pre-lanzamiento/construcci\u00f3n) a enteros sin limitar su longitud. Un \u00fanico componente grande de solo d\u00edgitos, por lo tanto, fuerza una conversi\u00f3n superlineal, no productiva, de base-10 a entero de precisi\u00f3n arbitraria (String.to_integer/1, es decir, :erlang.binary_to_integer/1) que fija un planificador BEAM, y un componente m\u00e1s grande genera un SystemLimitError no capturado que bloquea el proceso de llamada. Una \u00fanica cadena de tama\u00f1o moderado (alrededor de un megabyte) es suficiente; no se requiere autenticaci\u00f3n.\n\nEsto es accesible desde los puntos de entrada p\u00fablicos Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, y Version.parse_requirement/1, que las aplicaciones llaman rutinariamente en entradas no confiables como par\u00e1metros HTTP, campos de manifiesto de dependencia y metadatos de paquete.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/version.ex y las rutinas de programa \u0027Elixir.Version.Parser\u0027:parse_digits/2.\n\nEste problema afecta a Elixir: desde 1.5.0 antes de 1.20.1."
    }
  ],
  "id": "CVE-2026-49762",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49762",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T14:48:56.343391Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T14:16:44.317",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-49762.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

MSRC_CVE-2026-49762

Vulnerability from csaf_microsoft - Published: 2026-06-02 00:00 - Updated: 2026-06-28 01:58

Summary

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-49762

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 21444-17084		—
Unresolved product id: 21496-17084		—

Known affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 17084-2		—	Vendor Fix fix
Unresolved product id: 17084-1		—	Vendor Fix fix

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-49762 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-49762.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service",
    "tracking": {
      "current_release_date": "2026-06-28T01:58:48.000Z",
      "generator": {
        "date": "2026-06-28T07:10:57.287Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-49762",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-10T01:05:42.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-06-15T01:42:16.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-06-28T01:58:48.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 elixir 0:1.16.1-1.azl3",
                "product": {
                  "name": "\u003cazl3 elixir 0:1.16.1-1.azl3",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 elixir 0:1.16.1-1.azl3",
                "product": {
                  "name": "azl3 elixir 0:1.16.1-1.azl3",
                  "product_id": "21444"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 elixir 0:1.16.1-2.azl3",
                "product": {
                  "name": "\u003cazl3 elixir 0:1.16.1-2.azl3",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 elixir 0:1.16.1-2.azl3",
                "product": {
                  "name": "azl3 elixir 0:1.16.1-2.azl3",
                  "product_id": "21496"
                }
              }
            ],
            "category": "product_name",
            "name": "elixir"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 elixir 0:1.16.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 elixir 0:1.16.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "21444-17084"
        },
        "product_reference": "21444",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 elixir 0:1.16.1-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 elixir 0:1.16.1-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "21496-17084"
        },
        "product_reference": "21496",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49762",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "general",
          "text": "EEF",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21444-17084",
          "21496-17084"
        ],
        "known_affected": [
          "17084-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-49762 Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-49762.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T01:05:42.000Z",
          "details": "0:1.16.1-2.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-2",
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service"
    }
  ]
}

ubuntu-cve-2026-49762

Vulnerability from osv_ubuntu

Published

2026-06-09 14:16

Modified

2026-06-09 14:16

Summary

Details

Severity

5.1 (Medium)


                    
                      CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-49762	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-49762	REPORT
	https://github.com/elixir-lang/elixir/security/ad…	REPORT
	https://cna.erlef.org/cves/CVE-2026-49762.html	REPORT
	https://osv.dev/vulnerability/EEF-CVE-2026-49762	REPORT
	https://github.com/elixir-lang/elixir/commit/c644…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.1.0~0.20150708-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.1.0~0.20150708-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.0~0.20150708-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.3.3-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.3.3-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.3-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.9.1.dfsg-1.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.9.1.dfsg-1.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.1.dfsg-1",
        "1.9.1.dfsg-1.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.12.2.dfsg-2.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.12.2.dfsg-2.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.3.dfsg-1.1",
        "1.12.2.dfsg-2.1",
        "1.12.2.dfsg-2.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.14.0.dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.14.0.dfsg-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.14.0.dfsg-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.18.3.dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.18.3.dfsg-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.1.dfsg-1.1",
        "1.18.3.dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "elixir",
            "binary_version": "1.18.3.dfsg-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "elixir-lang",
        "purl": "pkg:deb/ubuntu/elixir-lang@1.18.3.dfsg-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.18.3.dfsg-1",
        "1.18.3.dfsg-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Uncontrolled Resource Consumption vulnerability in the Elixir standard library\u0027s Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines \u0027Elixir.Version.Parser\u0027:parse_digits/2. This issue affects Elixir: from 1.5.0 before 1.20.1.",
  "id": "UBUNTU-CVE-2026-49762",
  "modified": "2026-06-09T14:16:00Z",
  "published": "2026-06-09T14:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-49762"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49762"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p"
    },
    {
      "type": "REPORT",
      "url": "https://cna.erlef.org/cves/CVE-2026-49762.html"
    },
    {
      "type": "REPORT",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49762"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140978d9e"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-49762"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-49762 (GCVE-0-2026-49762)

CERTFR-2026-AVI-0753

Solutions

FKIE_CVE-2026-49762

MSRC_CVE-2026-49762

ubuntu-cve-2026-49762

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature