Source: elixir-lang Version: 1.20.1.dfsg-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for elixir-lang. CVE-2026-75758[0]: | Uncontrolled Recursion vulnerability in the Elixir standard library | allows an attacker who controls a list passed to inspect/1, | List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's | memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex | classifies a list as a charlist using List.ascii_printable?/2, which | examines only the first :printable_limit (4096 by default) elements, | and then calls IO.chardata_to_string/1 on the whole term. A list | whose printable prefix exceeds that limit but which contains a later | element that is not a code point (an atom, an out-of-range integer, | or an improper tail) is therefore mis-classified, and the conversion | raises ArgumentError. That conversion runs inside List.to_string/1, | whose rescue clause builds its message by interpolating | inspect(list), which re-enters the same branch and raises again. The | nested inspection is an argument to raise, so the recursion is not | in tail position and every level is retained: the process stack | grows monotonically while each cycle re-walks the list, until the | process is killed by max_heap_size or, by default, the node runs out | of memory. List.to_charlist/1 has the same rescue shape. Below the | printable limit the inner inspect/1 sees the invalid element within | its counter and renders the list in ordinary bracket form, so a | single ArgumentError is raised and no recursion occurs. This issue | affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 | before 1.19.6, and from 1.20.0-rc.0 before 1.20.4. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-75758 https://www.cve.org/CVERecord?id=CVE-2026-75758 [1] https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c [2] https://cna.erlef.org/cves/CVE-2026-75758.html [3] https://osv.dev/vulnerability/EEF-CVE-2026-75758 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
