Erlang/OTP CVE-2026-59696

The application must call uri_string:parse/1 (or any OTP function that internally delegates to it) on a URI supplied or influenced by an attacker, with no prior validation of the port component's length. All four authority-parsing paths - host, registered-name, IPv4, and IPv6 - are affected, so no specific URI form or protocol is required. No authentication is required (CVSS PR:N) and no non-default configuration is needed; the vulnerable code path is reached by the standard documented API in its default state. Applications that do not parse attacker-supplied URIs through this API are not affected. The primary factor limiting impact is that each malicious request causes a per-process delay rather than a crash or data exposure; an attacker must sustain request volume to cause meaningful service degradation, and network-layer rate limiting significantly reduces exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) characterizes a low-complexity, unauthenticated network attack with limited availability impact - per-process CPU stalling rather than a crash or data breach. No EPSS score was included in the source intelligence data, and the vulnerability has not been added to CISA KEV; exploitation probability is inferred from the attack description and vector rather than confirmed telemetry. The practical attack surface is significant: uri_string:parse/1 is the standard OTP URI-parsing interface, so any networked Erlang service that accepts user-supplied URIs - HTTP servers, LDAP clients, webhook processors, API gateways - is exposed by default without requiring any non-default configuration. Even a mid-sized IT operation in gdynia running RabbitMQ, a Phoenix web application, or a custom Erlang HTTP service should treat this as a priority patch given the zero-friction, unauthenticated attack path and the breadth of the exposed API surface. Sustained service-level availability impact requires repeated requests since each individual request causes only a per-process delay, meaning rate limiting at the network edge meaningfully raises the practical bar; the absence of a crash or data exposure keeps this below critical severity despite the wide exposure.

An attacker sends an HTTP request or other network message to an Erlang application that calls uri_string:parse/1 on attacker-supplied input, embedding a URI such as http://example.com:11111...1/path with approximately one million digit characters as the port value. Each such request causes the receiving Erlang process to stall for hundreds of milliseconds of bignum arithmetic; by sending a sustained stream of such requests, the attacker degrades throughput or causes request timeouts without crashing the node or accessing any data. No public exploit code has been identified, but the attack requires no specialized tooling and is trivially constructable from the CVE description alone.