Elixir 1.18.6, 1.19.7, and 1.20.5 Fix Three Flaws
Tech GuruQuick Answer
The Elixir CNA records three Medium vulnerabilities in URI parsing, JSON integer parsing, and Mix deps.partition. Inventory runtime and build-host versions, update the maintained branch to 1.18.6, 1.19.7, or 1.20.5 as applicable, validate services and pipelines, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Elixir runtimes, Mix build hosts, container images, URI and JSON inputs, CI workspaces, local user boundaries, owners, and deployment pipelines. Match each CVE to its exact affected branch and feature; do not treat every Elixir service as remotely exploitable, because the Mix issue requires a local attacker. Update to the authority-listed fixed release for the maintained branch, rebuild images and dependencies, and restrict untrusted parser input and build-host access until complete. Confirm active runtime versions, exercise URI and JSON handling and Mix workflows, review resource anomalies or build-host activity where warranted, and retain package and pipeline evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Elixir standard library URI and JSON parsers and Mix deps.partition |
|---|---|
| Advisory | CVE-2026-109821 / CVE-2026-115274 / CVE-2026-97209 |
| CVEs | CVE-2026-109821, CVE-2026-115274, CVE-2026-97209 |
| Authoritative release date | 2026-10-30 08:59:17.615 UTC |
| Authority revision date | 2026-10-30 08:59:17.615 UTC |
| Affected versions | Elixir versions in the authority-listed branches before 1.18.6, 1.19.7, or 1.20.5 as applicable; the local Mix issue affects 1.20.0-rc.4 through 1.20.4. |
| Fixed version | Elixir 1.18.6, 1.19.7, or 1.20.5 according to the maintained branch and issue scope |
| CVSS base score | 5.4 / 6.3 / 6.9 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | The authority does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
The Erlang Ecosystem Foundation published fixes for URI port CPU exhaustion, JSON integer CPU and memory exhaustion, and local temporary-file code execution in Mix deps.partition.
What To Validate Now
- Inventory. Inventory Elixir runtimes, Mix build hosts, container images, URI and JSON inputs, CI workspaces, local user boundaries, owners, and deployment pipelines.
- Establish applicability. Match each CVE to its exact affected branch and feature; do not treat every Elixir service as remotely exploitable, because the Mix issue requires a local attacker.
- Remediate. Update to the authority-listed fixed release for the maintained branch, rebuild images and dependencies, and restrict untrusted parser input and build-host access until complete.
- Validate. Confirm active runtime versions, exercise URI and JSON handling and Mix workflows, review resource anomalies or build-host activity where warranted, and retain package and pipeline evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Parser limits and runtime updates can change application behavior. Test representative payloads and build tooling, and distinguish remote denial-of-service paths from the local Mix condition.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
