CVE catalog

CVE-2026-75758

Uncontrolled Recursion vulnerability in the Elixir…

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape. Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs. This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.

Severity: Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Aug 28, 2026, 11:28:53 AM UTC
Updated: Aug 28, 2026, 4:18:25 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.18% · Oct 27, 2026

Projects and upstream resources

[elixir-lang][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	elixir-lang	`1.20.4+dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2026-75758]
Debianforky	elixir-lang	`1.20.4+dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2026-75758]

Showing 2 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	elixir-lang	Not reported	Not affectedDistribution reports not affected	[CVE-2026-75758]
Debianbookworm	elixir-lang	`1.14.0.dfsg-2`	Not affected	[CVE-2026-75758]
Debianforky	elixir-lang	`1.20.4+dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2026-75758]
Debiansid	elixir-lang	`1.20.4+dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2026-75758]
Debiantrixie	elixir-lang	Not reported	AffectedDistribution reports no fix	[CVE-2026-75758]
Debiantrixie	elixir-lang	`1.18.3.dfsg-1`	Affected	[CVE-2026-75758]
Ubuntu14.04	elixir	`0.7.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC
Ubuntu14.04	elixir	`0.7.1-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC
Ubuntu14.04	elixir	`0.7.1-4build0.14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC
Ubuntu16.04	elixir	`0.7.1-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC
Ubuntu16.04	elixir	`0.7.1-4build0.16.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC
Ubuntu18.04	elixir	`0.7.1-4build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2026-75758]Sep 2, 2026, 4:27:46 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "elixir-lang",
      "status": "fixed",
      "release": "sid",
      "version": "1.20.4+dfsg-1"
    },
    {
      "name": "elixir-lang",
      "status": "fixed",
      "release": "forky",
      "version": "1.20.4+dfsg-1"
    },
    {
      "name": "elixir-lang",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.18.3.dfsg-1"
    },
    {
      "name": "elixir-lang",
      "status": "not affected",
      "release": "bookworm",
      "version": "1.14.0.dfsg-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1146626,
      "name": "elixir-lang",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.4+dfsg-1"
    },
    {
      "bug": 1146626,
      "name": "elixir-lang",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.4+dfsg-1"
    },
    {
      "bug": 1146626,
      "name": "elixir-lang",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1146626,
      "name": "elixir-lang",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "elixir",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "0.7.1-1",
        "0.7.1-2",
        "0.7.1-4build0.14.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-75758",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-75758",
      "provider_updated_at": "2026-09-02T16:27:46Z",
      "applicability_unknown": true
    },
    {
      "name": "elixir",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "0.7.1-3",
        "0.7.1-4build0.16.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-75758",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-75758",
      "provider_updated_at": "2026-09-02T16:27:46Z",
      "applicability_unknown": true
    },
    {
      "name": "elixir",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "0.7.1-4build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-75758",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-75758",
      "provider_updated_at": "2026-09-02T16:27:46Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1146626]

Publisher notes

[trixie] elixir-lang: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[elixir]Unknown
Source package: [elixir-lang]
Details (2)
- 1.14.0.dfsg-2 · amd64 · bookworm
  Not affected
  nvd · elixir-lang · debian · bookworm
- 1.14.0.dfsg-2 · arm64 · bookworm
  Not affected
  nvd · elixir-lang · debian · bookworm

[Debian 13 (Trixie)]

[elixir]Unknown
Source package: [elixir-lang]
Details (2)
- 1.18.3.dfsg-1 · amd64 · trixie
  Affected
  nvd · elixir-lang · debian · 13
- 1.18.3.dfsg-1 · arm64 · trixie
  Affected
  nvd · elixir-lang · debian · 13

Observed: Oct 23, 2026, 9:33:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]