Erlang vulnerabilities
67 CVEs and advisories name Erlang as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-42792epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-58227TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
- CVE-2026-54891Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl
- CVE-2026-55950DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions
- CVE-2026-54886SSH SFTP server denial of service via extended channel data infinite loop
- CVE-2026-55952TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension
- CVE-2026-54887DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-53422SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
- CVE-2026-48856httpc leaks Authorization header to cross-origin redirect targets
- CVE-2026-48860Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
- CVE-2026-48855SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
- CVE-2026-48858ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
- CVE-2026-48859SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration
- CVE-2026-49759Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-49760Stack Buffer Overflow in ei_s_print_term at Very Large Integer
- CVE-2026-42790nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification
- CVE-2026-42791OCSP responder certificate validity period not checked in public_key
- CVE-2026-42789Non-CA certificate accepted as intermediate issuer in public_key path validation
- CVE-2026-32147SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
- CVE-2026-28808ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
- CVE-2026-32144OCSP designated-responder authorization bypass via missing signature verification
- CVE-2026-28810Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
- CVE-2026-23941Request smuggling via first-wins Content-Length parsing in inets httpd
- CVE-2026-23943Pre-auth SSH DoS via unbounded zlib inflate
- CVE-2026-23942SFTP root escape via component-agnostic prefix check in ssh_sftpd
- CVE-2026-21619Unsafe Deserialization of Erlang Terms in hex_core
- CVE-2026-21620TFTP Path Traversal
- CVE-2025-48041SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
- CVE-2025-48040Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
- CVE-2025-48039Unverified Paths can Cause Excessive Use of System Resources