{
  "cveId": "CVE-2026-75758",
  "url": "https://patchblox.com/security/cve/CVE-2026-75758",
  "summary": "CVE-2026-75758 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2026-75758, released September 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "elixir-lang: Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to...",
  "description": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node\u0027s memory.  Inspect.List\u0027s charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.  Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.  This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.",
  "published": "2026-08-28T16:18:25Z",
  "severity": "moderate",
  "epss": 0.0018,
  "epssPercentile": 0.07609,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "elixir",
      "release": "Fedora 43",
      "fixedVersion": "1.19.7-1.fc43",
      "fix": "FEDORA-2026-F5E380A553",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-f5e380a553",
      "released": "2026-11-08T02:01:48Z"
    },
    {
      "platform": "linux",
      "product": "elixir-doc",
      "release": "Fedora 43",
      "fixedVersion": "1.19.7-1.fc43",
      "fix": "FEDORA-2026-F5E380A553",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-f5e380a553",
      "released": "2026-11-08T02:01:48Z"
    },
    {
      "platform": "linux",
      "product": "elixir-lang",
      "release": "Debian 14",
      "fixedVersion": "1.20.4\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-75758",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-75758",
      "released": "2026-09-17T18:08:56Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}