Vulnerabilities

TI-2026-49187 CVE-2026-70405

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

LOW 29

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily l…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0071 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-1284

TI-2026-47459 CVE-2026-66835

httpd mod_auth directory protection bypassed by a doubled slash in the request path

LOW 38

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00973 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-50

TI-2026-51404 CVE-2026-73270

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

LOW 37

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on depl…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00927 Published 2026-09-01 Partial fix · 27.3.4.17, 28.5.0.6 +4 CWE-178

TI-2026-52886 CVE-2026-75538

Heap-based buffer overflow in Erlang OTP

LOW 37

An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00854 Published 2026-09-01 Partial fix · 27.3.4.17, 28.5.0.6 +4 CWE-122

TI-2026-52695 CVE-2026-74994

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

LOW 28

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group nam…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00633 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-1289

TI-2026-52570 CVE-2026-74835

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

MEDIUM 44

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00577 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-770

TI-2026-51857 CVE-2026-73812

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

LOW 37

httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-444

TI-2026-47131 CVE-2026-66357

inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

LOW 37

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines).

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00577 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-444

TI-2026-40357 CVE-2026-55951

httpc memory exhaustion via unbounded response header accumulation

LOW 37

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00694 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-770

TI-2026-50021 CVE-2026-71380

httpd applies no timeout while receiving a request body, parking a worker on a stalled client

MEDIUM 45

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Leng…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00673 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-772

TI-2026-50133 CVE-2026-71562

httpc does not bound server-supplied numeric header values before integer conversion

LOW 29

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long ru…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00577 Published 2026-09-01 Fixed in 27.3.4.17, 28.5.0.6 +4 CWE-1284

Vulnerabilities

Filters