Elixir CVE-2026-49762

Exploitation requires that an attacker can supply a string to any of five specific public functions: Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, or Version.parse_requirement/1, where at least one dot-delimited segment of the version string consists entirely of decimal digits and exceeds 14 characters in length (approximately 1 MB is sufficient for significant scheduler impact). No authentication is required against the Elixir library itself (PR:N in CVSS vector). Applications that only parse version strings generated internally or from already-validated sources are not exploitable. Exploitation is further limited to processes that call these functions on external input - common in package managers, CI/CD dependency resolvers, API endpoints accepting version constraints, and systems processing third-party package manifests. The CVSS AV:L designation may cause defenders to underestimate risk: the library is local, but the data path from network to vulnerable function is direct and common in web-facing Elixir applications.

CVSS 4.0 scores this 5.1 (Medium) with AV:L/AC:L/AT:N/PR:N/UI:N and impact limited to VA:L - local availability only, no confidentiality or integrity impact. The AV:L designation warrants scrutiny: the CVSS vector scores the library in isolation, but the description explicitly identifies HTTP request parameters and package manifest fields as routine call sites, meaning deployed web services effectively expose this to unauthenticated remote attackers. This is a meaningful real-world discrepancy defenders should assess against their own deployment. The attack requires no authentication (PR:N), no user interaction (UI:N), and no special configuration - only that the application passes external input to a Version function. There is no CISA KEV listing and no public exploit identified at time of analysis, suggesting no current widespread exploitation. The triviality of constructing the payload (a long digit string) means exploitation barrier is very low if the entry point is reachable. Impact is constrained to availability - process crash or scheduler starvation - with no data exfiltration risk.

An attacker submits an HTTP GET request to a package registry or dependency-checking API endpoint with a version query parameter set to a string like '1.0.0-' followed by approximately one million ASCII digit characters. The server-side handler calls Version.match?/3 or Version.parse/1 on this value without prior validation. The BEAM scheduler servicing the request becomes pinned for an extended period executing :erlang.binary_to_integer/1 on the oversized component, starving other processes on that scheduler and causing request timeouts or a process crash. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the public vulnerability description and commit diff alone.