Medium severity · published Apr 7, 2016
CVE-2015-2774
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data…
5.9
CVSS
1.9%
EPSS
No
On KEV
Description
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Erlang/otp · Erlang
through 18.0 · source: NVD
OP
Opensuse · Opensuse
13.2 · source: NVD
SO
Solaris · Oracle
11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2774
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2774
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html
Third Party Advisory
http://openwall.com/lists/oss-security/2015/03/27/6
openwall.com
http://openwall.com/lists/oss-security/2015/03/27/9
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
www.securityfocus.com
http://www.securityfocus.com/bid/73398
usn.ubuntu.com
https://usn.ubuntu.com/3571-1/
More from Erlang/otp
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
9.8
CVE-2026-28808
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
9.8
CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and…
9.8
CVE-2016-10253
An issue was discovered in Erlang/OTP 18.x
9.4
CVE-2026-23941
Request smuggling via first-wins Content-Length parsing in inets httpd