Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape. Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs. This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list     passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory.
    Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using     List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and     then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but     which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper     tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside     List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters     the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not     in tail position and every level is retained: the process stack grows monotonically while each cycle re-     walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory.
    List.to_charlist/1 has the same rescue shape. Below the printable limit the inner inspect/1 sees the     invalid element within its counter and renders the list in ordinary bracket form, so a single     ArgumentError is raised and no recursion occurs. This issue affects elixir: from 1.15.0-rc.0 before     1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4. (CVE-2026-75758)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ab3c852-d10a-4d68-be6b-80619116c33a advisory.

    tomciopp reports:
    Uncontrolled recursion in the Elixir standard library lets an                 attacker who controls a list passed to inspect/1,                 List.to_string/1, or List.to_charlist/1 exhaust a BEAM node's                 memory.
    Inspect.List checks only a bounded prefix (4096 elements by                 default) to determine whether a list is a charlist, then attempts                 to convert the entire list. When a list contains a long printable                 prefix followed by an invalid element, the classification passes                 but the conversion fails. The error handling path then inspects                 the same list again, creating unbounded recursion that grows                 process memory until heap limits are exceeded or the node                 exhausts resources.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the aac25935-f19d-4ac8-80fc-043365686a63 advisory.

    tomciopp reports:
    Uncontrolled recursion in the Elixir standard library lets an                 attacker who controls a list passed to inspect/1,                 List.to_string/1, or List.to_charlist/1 exhaust a BEAM node's                 memory.
    Inspect.List checks only a bounded prefix (4096 elements by                 default) to determine whether a list is a charlist, then attempts                 to convert the entire list. When a list contains a long printable                 prefix followed by an invalid element, the classification passes                 but the conversion fails. The error handling path then inspects                 the same list again, creating unbounded recursion that grows                 process memory until heap limits are exceeded or the node                 exhausts resources.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
341946	Linux Distros Unpatched Vulnerability : CVE-2026-75758	Nessus	Misc.	Local	medium
341548	FreeBSD : Elixir -- Denial of service via uncontrolled recursion in charlist conversion (2ab3c852-d10a-4d68-be6b-80619116c33a)	Nessus	FreeBSD Local Security Checks	Local	medium
341546	FreeBSD : Elixir -- Denial of service via uncontrolled recursion in charlist conversion (aac25935-f19d-4ac8-80fc-043365686a63)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-75758

medium

Tenable Plugins

medium

medium

medium