# cve.now: Erlang

The newest entries naming Erlang as an affected vendor (up to 200), of 67 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-96596](https://cve.now/CVE-2026-96596.md): erl\_tar:extract/2 loops forever on a GNU sparse member with a trailing hole (CVSS 5.9)
- [CVE-2026-105236](https://cve.now/CVE-2026-105236.md): TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries (CVSS 6.3)
- [CVE-2026-94200](https://cve.now/CVE-2026-94200.md): TLS 1.3 client ticket store crashed by NewSessionTicket with empty early\_data extension in ssl (CVSS 8.2)
- [CVE-2026-105274](https://cve.now/CVE-2026-105274.md): hex\_core decompresses registry and Erlang term API responses without size limits (CVSS 2.1)
- [CVE-2026-103060](https://cve.now/CVE-2026-103060.md): Path traversal in rebar3 via unvalidated dependency app names (CVSS 7.5)
- [CVE-2026-65634](https://cve.now/CVE-2026-65634.md): Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder (CVSS 8.2)
- [CVE-2026-68956](https://cve.now/CVE-2026-68956.md): SSH daemon allocates unbounded idle session channels, bypassing max\_channels (CVSS 7.1)
- [CVE-2026-89422](https://cve.now/CVE-2026-89422.md): TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre\_shared\_key extension (CVSS 9.3)
- [CVE-2026-69664](https://cve.now/CVE-2026-69664.md): httpd parks a request worker indefinitely on a malformed chunk size sent after the headers (CVSS 8.7)
- [CVE-2026-70409](https://cve.now/CVE-2026-70409.md): eldap does not bound the port component of a referral URL before integer conversion (CVSS 6.3)
- [CVE-2026-70405](https://cve.now/CVE-2026-70405.md): snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields (CVSS 6.3)
- [CVE-2026-66835](https://cve.now/CVE-2026-66835.md): httpd mod\_auth directory protection bypassed by a doubled slash in the request path (CVSS 8.2)
- [CVE-2026-73270](https://cve.now/CVE-2026-73270.md): httpd mod\_auth directory protection bypassed by request path casing on case-insensitive filesystems (CVSS 8.2)
- [CVE-2026-75538](https://cve.now/CVE-2026-75538.md): A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer (CVSS 8.2)
- [CVE-2026-74994](https://cve.now/CVE-2026-74994.md): inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod\_auth (CVSS 6.0)
- [CVE-2026-74835](https://cve.now/CVE-2026-74835.md): inets,httpd: Memory Exhaustion via Unenforced max\_body\_size During Chunked Body Reception (CVSS 8.7)
- [CVE-2026-73812](https://cve.now/CVE-2026-73812.md): inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length (CVSS 8.3)
- [CVE-2026-73276](https://cve.now/CVE-2026-73276.md): inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i (CVSS 8.3)
- [CVE-2026-66357](https://cve.now/CVE-2026-66357.md): inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation (CVSS 8.3)
- [CVE-2026-59696](https://cve.now/CVE-2026-59696.md): uri\_string does not bound the port component of a URI before integer conversion (CVSS 6.9)
- [CVE-2026-55951](https://cve.now/CVE-2026-55951.md): httpc memory exhaustion via unbounded response header accumulation (CVSS 8.2)
- [CVE-2026-71380](https://cve.now/CVE-2026-71380.md): httpd applies no timeout while receiving a request body, parking a worker on a stalled client (CVSS 8.7)
- [CVE-2026-71562](https://cve.now/CVE-2026-71562.md): httpc does not bound server-supplied numeric header values before integer conversion (CVSS 6.3)
- [CVE-2026-70399](https://cve.now/CVE-2026-70399.md): httpd does not enforce the documented default max\_clients connection limit (CVSS 8.7)
- [CVE-2026-54890](https://cve.now/CVE-2026-54890.md): BEAM VM crash via integer underflow in binary\_to\_term BIT\_BINARY\_EXT decoding (CVSS 8.2)
- [CVE-2026-59251](https://cve.now/CVE-2026-59251.md): Denial of service via exponential certificate policy tree growth in path validation (CVSS 8.7)
- [CVE-2026-59250](https://cve.now/CVE-2026-59250.md): Megaco flex scanner buffer overflow via oversized property parm name (CVSS 8.3)
- [CVE-2026-55953](https://cve.now/CVE-2026-55953.md): TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication (CVSS 9.1)
- [CVE-2026-55737](https://cve.now/CVE-2026-55737.md): Heap pointer corruption via signed/unsigned mismatch in LARGE\_TUPLE\_EXT decoding in erts external term format decoder (CVSS 5.1)
- [CVE-2026-47078](https://cve.now/CVE-2026-47078.md): Relative path traversal in zip:unzip/zip:extract via check\_dir\_level depth-counter bypass (CVSS 4.8)
- [CVE-2026-42792](https://cve.now/CVE-2026-42792.md): epmd permanent DoS via EMFILE on accept(2) in erts (CVSS 6.3)
- [CVE-2026-58227](https://cve.now/CVE-2026-58227.md): TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (CVSS 8.7)
- [CVE-2026-54891](https://cve.now/CVE-2026-54891.md): Plaintext APPLICATION\_DATA injected during TLS handshake delivered to client application post-handshake in ssl (CVSS 6.3)
- [CVE-2026-55950](https://cve.now/CVE-2026-55950.md): DTLS listener crash via race condition in dtls\_packet\_demux causes denial of service for all sessions (CVSS 8.7)
- [CVE-2026-54886](https://cve.now/CVE-2026-54886.md): SSH SFTP server denial of service via extended channel data infinite loop (CVSS 5.3)
- [CVE-2026-55952](https://cve.now/CVE-2026-55952.md): TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension (CVSS 8.2)
- [CVE-2026-54887](https://cve.now/CVE-2026-54887.md): DTLS server cookie bypass during startup window due to empty initial cookie secret (CVSS 6.3)
- [CVE-2026-53422](https://cve.now/CVE-2026-53422.md): SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root (CVSS 2.3)
- [CVE-2026-48856](https://cve.now/CVE-2026-48856.md): httpc leaks Authorization header to cross-origin redirect targets (CVSS 7.1)
- [CVE-2026-48860](https://cve.now/CVE-2026-48860.md): Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet\_tls\_dist (CVSS 7.5)
- [CVE-2026-48855](https://cve.now/CVE-2026-48855.md): SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured (CVSS 2.3)
- [CVE-2026-48858](https://cve.now/CVE-2026-48858.md): ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks (CVSS 6.3)
- [CVE-2026-48859](https://cve.now/CVE-2026-48859.md): SSH server timing side-channel in ssh\_auth:check\_password/3 allows unauthenticated username enumeration (CVSS 6.3)
- [CVE-2026-49759](https://cve.now/CVE-2026-49759.md): Stack buffer overflow in SCTP error cause parsing in inet\_drv allows remote VM crash (CVSS 8.8)
- [CVE-2026-49760](https://cve.now/CVE-2026-49760.md): Stack Buffer Overflow in ei\_s\_print\_term at Very Large Integer (CVSS 6.9)
- [CVE-2026-42790](https://cve.now/CVE-2026-42790.md): nameConstraints DNS bypass via subject CommonName fallback in public\_key hostname verification (CVSS 7.6)
- [CVE-2026-42791](https://cve.now/CVE-2026-42791.md): OCSP responder certificate validity period not checked in public\_key (CVSS 6.3)
- [CVE-2026-42789](https://cve.now/CVE-2026-42789.md): Non-CA certificate accepted as intermediate issuer in public\_key path validation (CVSS 7.0)
- [CVE-2026-32147](https://cve.now/CVE-2026-32147.md): SFTP chroot bypass via path traversal in SSH\_FXP\_FSETSTAT (CVSS 5.3)
- [CVE-2026-28808](https://cve.now/CVE-2026-28808.md): ScriptAlias CGI targets bypass directory auth in inets httpd (mod\_auth vs mod\_cgi path mismatch) (CVSS 8.3)
- [CVE-2026-32144](https://cve.now/CVE-2026-32144.md): OCSP designated-responder authorization bypass via missing signature verification (CVSS 7.6)
- [CVE-2026-28810](https://cve.now/CVE-2026-28810.md): Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver (CVSS 6.3)
- [CVE-2026-23941](https://cve.now/CVE-2026-23941.md): Request smuggling via first-wins Content-Length parsing in inets httpd (CVSS 7.0)
- [CVE-2026-23943](https://cve.now/CVE-2026-23943.md): Pre-auth SSH DoS via unbounded zlib inflate (CVSS 6.9)
- [CVE-2026-23942](https://cve.now/CVE-2026-23942.md): SFTP root escape via component-agnostic prefix check in ssh\_sftpd (CVSS 5.3)
- [CVE-2026-21619](https://cve.now/CVE-2026-21619.md): Unsafe Deserialization of Erlang Terms in hex\_core (CVSS 2.0)
- [CVE-2026-21620](https://cve.now/CVE-2026-21620.md): TFTP Path Traversal (CVSS 2.3)
- [CVE-2025-48041](https://cve.now/CVE-2025-48041.md): SSH\_FXP\_OPENDIR may Lead to Exhaustion of File Handles (CVSS 7.1)
- [CVE-2025-48040](https://cve.now/CVE-2025-48040.md): Malicious Key Exchange Messages may Lead to Excessive Resource Consumption (CVSS 6.9)
- [CVE-2025-48039](https://cve.now/CVE-2025-48039.md): Unverified Paths can Cause Excessive Use of System Resources (CVSS 5.3)
- [CVE-2025-48038](https://cve.now/CVE-2025-48038.md): Unverified File Handles can Cause Excessive Use of System Resources (CVSS 5.3)
- [CVE-2025-4748](https://cve.now/CVE-2025-4748.md): Absolute path traversal in zip:unzip/1,2 (CVSS 4.8)
- [CVE-2025-46712](https://cve.now/CVE-2025-46712.md): Erlang/OTP SSH Has Strict KEX Violations (CVSS 3.7)
- [CVE-2025-32433](https://cve.now/CVE-2025-32433.md): Erlang/OTP SSH Vulnerable to Pre-Authentication RCE (CVSS 10.0, KEV)
- [CVE-2025-30211](https://cve.now/CVE-2025-30211.md): KEX init error results with excessive memory usage (CVSS 7.5)
- [CVE-2025-26618](https://cve.now/CVE-2025-26618.md): SSH SFTP packet size not verified properly in Erlang OTP (CVSS 7.0)
- [CVE-2024-53846](https://cve.now/CVE-2024-53846.md): ssl fails to validate incorrect extened key usage (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/erlang
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.