$ the-wire · showcase
Elixir patches JSON and URI denial-of-service bugs
By RepoJournal · Filed · About Elixir & Phoenix · Composed from the cited sources · methodology
2 people shipped this
Elixir shipped fixes for two parser-level denial-of-service holes and a local privilege escalation in mix, the first security work of the day and the only part of this wire that obliges anyone to act.
Raise when decoding integers in json beyond float range (CVE-2026-115274) elixir-lang/elixir
JSON.decode/1 now raises when it encounters an integer beyond float range instead of parsing it, fixing the CPU and memory exhaustion path identified as CVE-2026-115274. Any endpoint that hands untrusted JSON to Jason-backed decoding is exposed until you take the fix.
Validate deps.partition configuration with checksum (CVE-2026-97209) elixir-lang/elixir
mix deps.partition now checks a checksum when validating its configuration, addressing CVE-2026-97209 and the insecure temporary file that let a local user run code inside another user's dependency build. The fix comes from José Valim alongside the parser patch, so both arrive in the same upgrade.
Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service elixir-lang/elixir
URI.parse/1 had an unbounded port parsing path that let a crafted URI burn CPU; the patch caps it. If you parse user-supplied URLs for redirects, webhooks, or link previews, this one is squarely in your request path.
Correct documentation for empty_values in Changeset.validate_required/3 (#4810) elixir-ecto/ecto
Ecto corrected the documentation for the :empty_values option in Changeset.validate_required/3, so the docs now describe what the function actually does. Behavior is unchanged, but anyone who shaped validation rules around the old wording should reread it.
Action items
- → Upgrade Elixir to a build carrying the JSON and URI parser fixes (CVE-2026-115274, CVE-2026-97209) before your next d... elixir-lang/elixir [immediate]
