Erlang vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Erlang flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-32433 Erlang Erlang/OTP SSH Server Missing Authentication for Critical FunctionExploited since Jun 9, 2025 · CVSS 10

Latest high and critical flaws

• CVE-2026-94200 Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a High 8.2 · Oct 14, 2026
• CVE-2026-103060 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a dHigh 7.5 · Oct 12, 2026
• CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended seCritical 9.3 · Sep 22, 2026
• CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedlHigh 7.1 · Sep 22, 2026
• CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sendiHigh 8.2 · Sep 22, 2026
• CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calcHigh 8.2 · Sep 1, 2026
• CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.High 8.7 · Sep 1, 2026
• CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as High 8.3 · Sep 1, 2026
• CVE-2026-73276 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.High 8.3 · Sep 1, 2026
• CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protectedHigh 8.2 · Sep 1, 2026
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servicHigh 8.7 · Sep 1, 2026
• CVE-2026-70399 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servicHigh 8.7 · Sep 1, 2026
• CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servicHigh 8.7 · Sep 1, 2026
• CVE-2026-66835 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixiHigh 8.2 · Sep 1, 2026
• CVE-2026-66357 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines).High 8.3 · Sep 1, 2026
• CVE-2026-55951 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server.High 8.2 · Sep 1, 2026
• CVE-2026-59251 Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service High 8.7 · Jul 27, 2026
• CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially High 8.3 · Jul 27, 2026
• CVE-2026-58227 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake.High 8.7 · Jul 27, 2026
• CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offereCritical 9.1 · Jul 27, 2026
• CVE-2026-54890 Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, ExcHigh 8.2 · Jul 27, 2026
• CVE-2026-55952 The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equalHigh 8.2 · Jul 2, 2026
• CVE-2026-55950 Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash High 8.7 · Jul 2, 2026
• CVE-2026-49759 Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTPHigh 8.8 · Jun 10, 2026
• CVE-2026-48860 Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN High 7.5 · Jun 10, 2026