CVE-2026-75758 elixir-lang CVE debrief

Who should care

Users of Elixir versions from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by an uncontrolled recursion in the Elixir standard library. The Inspect.List module mis-classifies a list as a charlist if its printable prefix exceeds the :printable_limit (4096 by default) but contains a later element that is not a code point. This leads to a recursive call to inspect/1, which can exhaust the process stack and cause the node to run out of memory. The vulnerability affects Elixir versions from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4, and can be exploited by an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1, potentially leading to a denial-of-service attack by exhausting the BEAM node's memory. Users of affected Elixir versions should update to a fixed version and implement input validation and sanitization to prevent malicious lists from being passed to the affected functions. Additionally, restricting access to the affected functions and monitoring system resources can help mitigate the vulnerability. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. The CVE record was published on 2026-08-28T16:18:25.277Z and has not been modified since then. The NVD entry is currently Deferred. To address this vulnerability, users should update Elixir to a version that fixes the vulnerability: 1.18.5, 1.19.6, or 1.20.4, and consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Monitoring system resources and implementing logging can also help detect potential attacks. Furthermore, reviewing the supplied official advisory or CVE record can help validate affected scope, severity, and vendor guidance. Confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up is also recommended. It is also recommended to restrict access to the affected functions (inspect/1, List.to_string/1, List.to_charlist/1) to trusted users. Implement input validation and sanitization to prevent malicious lists from being passed to the affected functions. Monitor system resources and implement logging to detect potential to

Defensive priority

This vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. It affects Elixir versions from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4. An attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 can exhaust a BEAM node's memory, leading to a denial-of-service attack.

Recommended defensive actions

• Update Elixir to a version that fixes the vulnerability: 1.18.5, 1.19.6, or 1.20.4.
• Restrict access to the affected functions (inspect/1, List.to_string/1, List.to_charlist/1) to trusted users.
• Implement input validation and sanitization to prevent malicious lists from being passed to the affected functions.
• Monitor system resources and implement logging to detect potential attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is caused by an uncontrolled recursion in the Elixir standard library. The Inspect.List module mis-classifies a list as a charlist if its printable prefix exceeds the :printable_limit (4096 by default) but contains a later element that is not a code point. This leads to a recursive call to inspect/1, which can exhaust the process stack and cause the node to run out of memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.