Erlang
Erlang OTP: vulnerabilidades y CVE
Erlang OTP tiene 31 vulnerabilidades publicadas, 22 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE31
Últimos 12 meses22
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-89422 | Crítica (9.3) | 0.64% | — | 22 sept 2026 | Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that… |
| CVE-2026-68956 | Alta (7.1) | 0.66% | — | 22 sept 2026 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a… |
| CVE-2026-65634 | Alta (8.2) | 0.42% | — | 22 sept 2026 | Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID… |
| CVE-2026-75538 | Alta (8.2) | 0.85% | — | 1 sept 2026 | An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM… |
| CVE-2026-74994 | Media (6) | 0.63% | — | 1 sept 2026 | The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group… |
| CVE-2026-74835 | Alta (8.7) | 0.58% | — | 1 sept 2026 | The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0… |
| CVE-2026-73812 | Alta (8.3) | 0.52% | — | 1 sept 2026 | httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by… |
| CVE-2026-73276 | Alta (8.3) | 0.58% | — | 1 sept 2026 | Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from… |
| CVE-2026-73270 | Alta (8.2) | 0.93% | — | 1 sept 2026 | Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on… |
| CVE-2026-71562 | Media (6.3) | 0.58% | — | 1 sept 2026 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long… |
| CVE-2026-71380 | Alta (8.7) | 0.67% | — | 1 sept 2026 | Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large… |
| CVE-2026-70409 | Media (6.3) | 0.58% | — | 1 sept 2026 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long… |
| CVE-2026-70405 | Media (6.3) | 0.71% | — | 1 sept 2026 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily… |
| CVE-2026-70399 | Alta (8.7) | 0.93% | — | 1 sept 2026 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of… |
| CVE-2026-66835 | Alta (8.2) | 0.97% | — | 1 sept 2026 | Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.… |
| CVE-2026-66357 | Alta (8.3) | 0.58% | — | 1 sept 2026 | httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security… |
| CVE-2026-59696 | Media (6.9) | 0.71% | — | 1 sept 2026 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.… |
| CVE-2026-55951 | Alta (8.2) | 0.69% | — | 1 sept 2026 | The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates… |
| CVE-2026-69664 | Alta (8.7) | 0.95% | — | 1 sept 2026 | Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size… |
| CVE-2026-59250 | Alta (8.3) | 0.78% | — | 27 jul 2026 | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash)… |
| CVE-2026-47078 | Media (4.8) | 0.15% | — | 27 jul 2026 | Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths… |
| CVE-2026-21620 | Baja (2.3) | 0.48% | — | 20 feb 2026 | Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative… |
| CVE-2025-48041 | Alta (7.1) | 0.39% | — | 11 sept 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files… |
| CVE-2025-48040 | Media (6.9) | 0.43% | — | 11 sept 2025 | Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue… |
| CVE-2025-48039 | Media (5.3) | 0.39% | — | 11 sept 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files… |
| CVE-2025-48038 | Media (5.3) | 0.39% | — | 11 sept 2025 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files… |
| CVE-2025-4748 | Media (4.8) | 0.29% | — | 16 jun 2025 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with… |
| CVE-2025-46712 | Baja (3.7) | 0.52% | — | 8 may 2025 | Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX… |
| CVE-2025-30211 | Alta (7.5) | 0.46% | — | 28 mar 2025 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does… |
| CVE-2025-26618 | Alta (7) | 0.49% | — | 20 feb 2025 | Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.