erlang vulnerabilities

Products

• erlangotp 71
• erlangssl 8
• erlangssh 7
• rebar3 6
• otp 5
• erlanginets 4
• erts 4
• erlangpublic key 2
• crypto 1
• erl interface 1
• ftp 1

Latest erlang CVEs

Newest publication first · page 1 of 4

1. CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

   Published 2026-10-14

   Medium·CVSS 5.9 EPSS 0.21%

   Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d...

2. CVE-2026-105236 TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries

   Published 2026-10-14

   Medium·CVSS 6.3 EPSS 0.36%

   Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serve...

3. CVE-2026-94200 TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

   Published 2026-10-14

   High·CVSS 8.2 EPSS 0.46%

   Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client deco...

4. CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.45%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_he...

5. CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

   Published 2026-10-12

   High·CVSS 7.5 EPSS 0.45%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies....

6. CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

   Published 2026-09-22

   High·CVSS 8.2 EPSS 0.27%

   Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_...

7. CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels

   Published 2026-09-22

   High·CVSS 7.1 EPSS 0.38%

   Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connection:handle_msg/4 checks...

8. CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

   Published 2026-09-22

   Critical·CVSS 9.3 EPSS 0.46%

   Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the hand...

9. CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

   Published 2026-09-01

   High·CVSS 8.7 EPSS 0.95%

   Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the con...

10. CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion

    Published 2026-09-01

    Medium·CVSS 6.3 EPSS 0.59%

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes the port substring s...

11. CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

    Published 2026-09-01

    Medium·CVSS 6.3 EPSS 0.71%

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 defaults its size limit...

12. CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path

    Published 2026-09-01

    High·CVSS 8.2 EPSS 0.97%

    Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI with uri_string:normali...

13. CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

    Published 2026-09-01

    High·CVSS 8.2 EPSS 0.93%

    Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. mod_auth:secre...

14. CVE-2026-75538 A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

    Published 2026-09-01

    High·CVSS 8.2 EPSS 0.85%

    An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash t...

15. CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

    Published 2026-09-01

    Medium·CVSS 6.0 EPSS 0.65%

    The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted...

16. CVE-2026-74835 inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

    Published 2026-09-01

    High·CVSS 8.7 EPSS 0.59%

    The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP befo...

17. CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

    Published 2026-09-01

    High·CVSS 8.3 EPSS 0.52%

    httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring fron...

18. CVE-2026-73276 inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

    Published 2026-09-01

    High·CVSS 8.3 EPSS 0.60%

    Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2.

19. CVE-2026-66357 inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

    Published 2026-09-01

    High·CVSS 8.3 EPSS 0.59%

    httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evo...

20. CVE-2026-59696 uri_string does not bound the port component of a URI before integer conversion

    Published 2026-09-01

    Medium·CVSS 6.9 EPSS 0.73%

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri_string:get_port/1 passes the port substring to binary_to_integer/1 with...

21. CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

    Published 2026-09-01

    High·CVSS 8.2 EPSS 0.69%

    The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only...

22. CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

    Published 2026-09-01

    High·CVSS 8.7 EPSS 0.67%

    Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete. httpd_requ...

23. CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

    Published 2026-09-01

    Medium·CVSS 6.3 EPSS 0.58%

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc_handler.erl converts the server-supplied...

24. CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

    Published 2026-09-01

    High·CVSS 8.7 EPSS 0.95%

    Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and...

25. CVE-2026-54890 BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

    Published 2026-07-27

    High·CVSS 8.2 EPSS 0.45%

    Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/exte...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.