CVE-2026-59696: CWE-1284 Improper Validation of Specified Quantity in Input in Erlang OTP

The vulnerability in Erlang/OTP stdlib involves improper validation of the port substring in URIs parsed by uri_string:get_port/1. This function passes the port substring to binary_to_integer/1 without limiting input length, allowing syntactically valid but extremely long numeric ports (up to approximately 1.26 million digits) to be processed. This results in high CPU usage due to arbitrary-precision arithmetic, degrading the availability of the affected process. The vulnerability is reachable through all authority-parsing paths in uri_string:parse/1, which is the documented URI parsing interface, exposing any application that parses attacker-controlled URIs. Affected versions include OTP 21.0 before 27.3.4.17, OTP 28.0 before 28.5.0.6, OTP 29.0 before 29.0.6, and corresponding stdlib versions 3.5 before 6.2.2.5, 7.0 before 7.3.0.2, and 8.0 before 8.0.4.

An attacker can supply a URI with an extremely long numeric port component, causing the vulnerable function to perform expensive arbitrary-precision integer conversion. This leads to significant CPU consumption and delays, degrading the availability of the Erlang process handling the URI parsing. There is no indication of privilege escalation, data disclosure, or code execution. The impact is limited to denial of service via resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, applications should avoid parsing untrusted URIs or implement input validation to limit the length of the port component before passing it to uri_string:get_port/1. Monitoring and rate-limiting URI parsing requests may help reduce exposure.