elixir-lang elixir
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97209 | 1.20.0-rc.4 – < 1.20.5 | Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-115274 | 1.18.0-rc.0 – < 1.18.6 ; 1.19.0-rc.0 – < 1.19.7 ; 1.20.0-rc.0 – < 1.20.5 | Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-109821 | 0.5.0 – < 1.18.6 ; 1.19.0-rc.0 – < 1.19.7 ; 1.20.0-rc.0 – < 1.20.5 | Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-75758 | 1.15.0-rc.0 – < 1.18.5 ; 1.19.0-rc.0 – < 1.19.6 ; 1.20.0-rc.0 – < 1.20.4 | Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-49762 | 0.9.3 – < 1.20.1 | Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service | MEDIUM 5.1 | 0.2 % |