CVE-2026-75758: CWE-674 Uncontrolled Recursion in elixir-lang elixir

The vulnerability arises because Inspect.List's charlist classification uses List.ascii_printable?/2 to check only the first 4096 elements of a list. If the list's printable prefix exceeds this limit but contains invalid elements later (such as atoms, out-of-range integers, or improper tails), the conversion to string raises an ArgumentError. The rescue clause in List.to_string/1 then attempts to build an error message by recursively calling inspect/1 on the same list, causing uncontrolled recursion that grows the process stack and eventually exhausts memory. List.to_charlist/1 exhibits the same behavior. Versions affected are from 1.15.0-rc.0 before 1.18.5, 1.19.0-rc.0 before 1.19.6, and 1.20.0-rc.0 before 1.20.4.

An attacker who can supply a crafted list to the affected functions can cause uncontrolled recursion leading to memory exhaustion of the BEAM node process. This can result in denial of service by crashing the process or exhausting node memory resources. There is no indication of code execution or privilege escalation. The CVSS 4.0 score is 5.9 (medium severity), reflecting local attack vector with partial attack complexity and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the data. Users should monitor the official Elixir project advisories for updates and apply any released patches promptly. Until a fix is available, avoid passing untrusted or crafted lists to inspect/1, List.to_string/1, and List.to_charlist/1 to mitigate risk.