Your message dated Thu, 10 Sep 2026 11:07:05 +0000
with message-id <[email protected]>
and subject line Bug#1146626: fixed in elixir-lang 1.20.4+dfsg-1
has caused the Debian Bug report #1146626,
regarding elixir-lang: CVE-2026-75758
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146626: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146626
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: elixir-lang
Version: 1.20.1.dfsg-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for elixir-lang.
CVE-2026-75758[0]:
| Uncontrolled Recursion vulnerability in the Elixir standard library
| allows an attacker who controls a list passed to inspect/1,
| List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's
| memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex
| classifies a list as a charlist using List.ascii_printable?/2, which
| examines only the first :printable_limit (4096 by default) elements,
| and then calls IO.chardata_to_string/1 on the whole term. A list
| whose printable prefix exceeds that limit but which contains a later
| element that is not a code point (an atom, an out-of-range integer,
| or an improper tail) is therefore mis-classified, and the conversion
| raises ArgumentError. That conversion runs inside List.to_string/1,
| whose rescue clause builds its message by interpolating
| inspect(list), which re-enters the same branch and raises again. The
| nested inspection is an argument to raise, so the recursion is not
| in tail position and every level is retained: the process stack
| grows monotonically while each cycle re-walks the list, until the
| process is killed by max_heap_size or, by default, the node runs out
| of memory. List.to_charlist/1 has the same rescue shape. Below the
| printable limit the inner inspect/1 sees the invalid element within
| its counter and renders the list in ordinary bracket form, so a
| single ArgumentError is raised and no recursion occurs. This issue
| affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0
| before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-75758
https://www.cve.org/CVERecord?id=CVE-2026-75758
[1]
https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c
[2] https://cna.erlef.org/cves/CVE-2026-75758.html
[3] https://osv.dev/vulnerability/EEF-CVE-2026-75758
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: elixir-lang
Source-Version: 1.20.4+dfsg-1
Done: Sergei Golovan <[email protected]>
We believe that the bug you reported is fixed in the latest version of
elixir-lang, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sergei Golovan <[email protected]> (supplier of updated elixir-lang package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 10 Sep 2026 13:43:06 +0300
Source: elixir-lang
Architecture: source
Version: 1.20.4+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Evgeny Golyshev <[email protected]>
Changed-By: Sergei Golovan <[email protected]>
Closes: 1146626
Changes:
elixir-lang (1.20.4+dfsg-1) unstable; urgency=medium
.
* New upstream release.
- Fix CVE-2026-75758: Uncontrolled Recursion vulnerability in the Elixir
standard library allows an attacker who controls a list passed
to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust
a BEAM node's memory.
Closes: #1146626.
* Change the DFSG suffix to +dfsg.
* Refresh patches.
* Add a patch which wixes checking for test results involving regular
expressions with filepaths.
Checksums-Sha1:
e7fc74c8238efdd83985fef9799acc06bc16dc40 2193 elixir-lang_1.20.4+dfsg-1.dsc
53e7142946164e592642b9916a8f09dc9f8714b3 2047000
elixir-lang_1.20.4+dfsg.orig.tar.xz
11cfb77cbfcf7804d56a9675c813c8a347744928 10128
elixir-lang_1.20.4+dfsg-1.debian.tar.xz
dfc39debb3e4a62fde7de89c8704f43e6dd06d0f 14562
elixir-lang_1.20.4+dfsg-1_amd64.buildinfo
Checksums-Sha256:
aab5ea840566dcdfa0fae8ff4658ad94ae4a6645ec4f3ba89ce0171d69186f61 2193
elixir-lang_1.20.4+dfsg-1.dsc
0883529a5bf99a4ce900371f9894e483df26f658d013a6f0929eef26eb9f3d87 2047000
elixir-lang_1.20.4+dfsg.orig.tar.xz
67651d6592e9bc3cca38655a572db155aec77d02c433b61b3bdfdec63936fc1a 10128
elixir-lang_1.20.4+dfsg-1.debian.tar.xz
aaad7798b59bf3a387e27bb5df1c38704ec7b12d2b62a64d026deb110418d587 14562
elixir-lang_1.20.4+dfsg-1_amd64.buildinfo
Files:
3763d288829cba5804162de37994ba6a 2193 interpreters optional
elixir-lang_1.20.4+dfsg-1.dsc
d6d3505afba95566e2ad75b67778b5cb 2047000 interpreters optional
elixir-lang_1.20.4+dfsg.orig.tar.xz
8f71e294aa9a55db8cfd9ffc184360c4 10128 interpreters optional
elixir-lang_1.20.4+dfsg-1.debian.tar.xz
2fa7dae28948489e7c2e21295d95900a 14562 interpreters optional
elixir-lang_1.20.4+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmqiiz0ACgkQTyrk60tj
54ebZA/+Npl0SFXOYvOxVIn+w+l9cj6RmHIMwOxqC8WX7UZ22mSy/EOudQDqjAff
ra1brS9lfi/wSg2D+q5Ed2HkiEdwOUL/XX84CGsRV4wLLqwQ5AvFQOXzZvrTmhPa
FOWmMQmlUHYC2m40ypw1Xn/zvj+LPqxmDd/3EL00yCV/wKWFZg2vYSPB9JdntdWn
Z/RPF2Xnt4MtICqc5fdeHiwdVXFF8sGmmhX+dx9par5Xe63caOF1jxI1SICDPEnE
Dsy2O8AFnam1GWHLOSNlNg449J+NgFyLqCtct7/pgSVuA4sppLLYSoRYm7Djokp4
SrYHlwc9ELarMTpk8Y2b1o278QUOuUeRsjp/b4nxRj68I3eAgDGTwabZFdzW7M98
cdyRt/ji3F8eF2/6vqtaalT5nW28seE2trc/glkNPcge78FKUe8Oh87PNqIzq5Ir
sycFG29vlmpD0znCE0slMWVRhAsRfHN14cybC1/GvqLc57Fwb4yto9J9BlQiJ4V3
Yu9NBDwP8yrBx4+bVYLGapW19Yo/1uXDYb3+eN1abG9tmuO/Z5BZF3LHCtHGlNZv
0DnyuWuSMHpGN8nLb0PIFFyajlHI3uY42w2iVyhdCecUDm5I+ou2laVOlbGxtQSO
kR4FYG7Xroko/HtX01r0Rym2+Vjj00tIsM2uZHxVq49yocPVE/s=
=lVxj
-----END PGP SIGNATURE-----
pgpkjGd077ZgG.pgp
Description: PGP signature
--- End Message ---
