Erlang

Records81All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high39CVSS 7.0–8.9

Exploited now

Erlang records in CISA KEV

TI-2025-23504 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability CRITICAL 100KEV 2025-06-09

Components

Products in the NVD configurations · select one to filter the records

Erlang/otp 41 records CRITICAL Erlang/ssl 8 records MEDIUM Erlang/ssh 7 records LOW Erlang/inets 4 records MEDIUM Erts 4 records MEDIUM Rebar3 3 records MEDIUM Erlang/public Key 2 records MEDIUM Crypto 1 record MEDIUM

Records

7 records in Erlang/ssh · all components

TI-2026-19286 CVE-2026-23943

Pre-auth SSH DoS via unbounded zlib inflate

LOW 38

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00684 Published 2026-03-13 No fix listed CWE-409

TI-2026-36123 CVE-2026-48859

SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration

LOW 34

Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00354 Published 2026-06-10 Fixed in 29.0.2, 6.0.1 CWE-208

TI-2026-19285 CVE-2026-23942

SFTP root escape via component-agnostic prefix check in ssh_sftpd

LOW 30

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00385 Published 2026-03-13 No fix listed CWE-22

TI-2026-39659 CVE-2026-54886

SSH SFTP server denial of service via extended channel data infinite loop

LOW 24

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-02 Partial fix CWE-400

TI-2026-24684 CVE-2026-32147

SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT

LOW 24

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-04-21 No fix listed CWE-22

TI-2026-38504 CVE-2026-53422

SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root

LOW 12

Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00262 Published 2026-07-02 Partial fix CWE-204

TI-2026-36120 CVE-2026-48855

SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

LOW 12

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00299 Published 2026-06-10 Partial fix CWE-200

Open these records in search →