FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Elixir -- Denial of service via uncontrolled recursion in charlist conversion

Affected packages
1.19.0 <= elixir-devel < 1.19.6
1.20.0 <= elixir-devel < 1.20.4

Details

VuXML ID 2ab3c852-d10a-4d68-be6b-80619116c33a
Discovery 2026-08-28
Entry 2026-08-28

tomciopp reports:

Uncontrolled recursion in the Elixir standard library lets an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 exhaust a BEAM node's memory.

Inspect.List checks only a bounded prefix (4096 elements by default) to determine whether a list is a charlist, then attempts to convert the entire list. When a list contains a long printable prefix followed by an invalid element, the classification passes but the conversion fails. The error handling path then inspects the same list again, creating unbounded recursion that grows process memory until heap limits are exceeded or the node exhausts resources.

References

CVE Name CVE-2026-75758
URL https://github.com/elixir-lang/elixir/releases/tag/v1.20.4
URL https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c