CVE-2026-59696 Erlang CVE debrief

Who should care

Defenders of applications using Erlang/OTP stdlib, especially those parsing URIs, should assess exposure and verify affected versions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure in applications parsing URIs, especially those using affected OTP versions.

Why it matters

CVE-2026-59696 is a medium-severity vulnerability in Erlang/OTP stdlib that can lead to degraded availability. Defenders should prioritize verifying exposure in applications parsing URIs, especially those using affected OTP versions, and implement input validation for URI port components.

• Degraded availability due to increased processing time for URI parsing
• Potential for denial-of-service (DoS) attacks through specially crafted URIs
• Need for input validation and bounding for URI port components
• Verification of affected OTP versions and application exposure

Technical summary

The uri_string:get_port/1 function in Erlang/OTP stdlib passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg. This allows a syntactically valid port of up to roughly 1.26 million digits to convert successfully, costing the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration.

Defensive priority

Defenders should prioritize verifying exposure in applications parsing URIs, especially those using affected OTP versions.

Recommended defensive actions

• Verify exposure in applications parsing URIs, especially those using affected OTP versions.
• Check for updates to OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6.
• Implement input validation for URI port components in applications using affected OTP versions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected applications and versions requires further verification. Affected applications using Erlang/OTP stdlib should verify exposure, especially those parsing URIs. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility. This issue is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.