# CVE-2026-59696: uri_string does not bound the port component of a URI before integer conversion

Status: published. Published: 2026-09-01. Updated: 2026-11-11.

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.

uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, 7.3.0.2, and 8.0.4.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa

## Affected products and versions

- Erlang / OTP (otp): ≥ 21.0; < * (affected, otp); unaffected at 27.3.4.17; unaffected at 28.5.0.6; unaffected at 29.0.6. Source: CNA: EEF
- Erlang / OTP (stdlib): ≥ 3.5; < * (affected, otp); unaffected at 6.2.2.5; unaffected at 7.3.0.2; unaffected at 8.0.4. Source: CNA: EEF
- Erlang / OTP (erlang/otp): ≥ 29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e; < * (affected, git); unaffected at aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d; unaffected at e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa. Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.71% as of 2026-11-10; percentile 53.84%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-1284

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2 (CNA: EEF; vendor-advisory)

- https://cna.erlef.org/cves/CVE-2026-59696.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-59696 (CNA: EEF; related)

- https://www.erlang.org/doc/system/versions.html#order-of-versions (CNA: EEF; x_version-scheme)

- https://github.com/erlang/otp/commit/29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e (CNA: EEF; related)

- https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d (CNA: EEF; patch)

- https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-59696; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-59696; retrieved 2026-11-11; source updated Not reported

Revision: 1f9e160d26bfd872bbf358c602b5a6e36facc5ab233e8bb59fc315daff504af3

Canonical: https://y2.dev/cve/CVE-2026-59696

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.