CVE-2026-59696 Erlang CVE debrief

Who should care

Defenders responsible for systems using Erlang/OTP, particularly those parsing URIs from untrusted sources, should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

A vulnerability in Erlang/OTP's stdlib allows remote attackers to degrade availability by supplying specially crafted URIs with very long port components, potentially causing performance issues due to excessive processing time in the `uri_string:get_port/1` function.

• Potential performance degradation due to excessive URI processing
• Increased risk of availability issues in systems parsing URIs from untrusted sources
• Need for defenders to assess exposure and prioritize patching or mitigation

Technical summary

The `uri_string:get_port/1` function in Erlang/OTP's stdlib does not properly validate the length of the port component in URIs, allowing remote attackers to cause performance issues by supplying specially crafted URIs with very long port components. This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms.

Defensive priority

Defenders should prioritize assessing exposure in systems using Erlang/OTP, particularly those parsing URIs from untrusted sources, and apply patches or mitigations as available.

Recommended defensive actions

• Assess exposure in systems using Erlang/OTP, particularly those parsing URIs from untrusted sources
• Apply patches or mitigations as available
• Monitor for potential performance issues due to excessive URI processing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source code changes and advisories. The issue is caused by the `uri_string:get_port/1` function not bounding the input length, allowing a remote attacker to cause performance issues by supplying a specially crafted URI with a very long port component. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.