This vulnerability in Elixir's Version module (lib/version.ex, Elixir.Version.Parser:parse_digits/2) involves uncontrolled resource consumption (CWE-400) when parsing numeric version components. The parser converts these components to integers without bounding their length, causing excessive CPU and memory use due to super-linear arbitrary-precision integer conversion. Large numeric components in version strings can pin a BEAM scheduler or cause a SystemLimitError that crashes the process. The issue affects Elixir versions from 1.5.0 before 1.20.1 and is reachable via public functions such as Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which are commonly called on untrusted input.

An attacker able to supply a crafted version string can cause denial of service by exhausting CPU and memory resources of the Elixir runtime, potentially crashing processes or degrading system performance. No authentication is required to trigger this vulnerability. This can disrupt applications that parse untrusted version strings, such as those processing HTTP parameters or dependency manifests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid parsing untrusted version strings or implement input validation to limit the length and format of numeric version components to prevent excessive resource consumption.