Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and…

An issue was discovered in Erlang/OTP 18.x

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling

TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

httpd applies no timeout while receiving a request body, parking a worker on a stalled client

httpd does not enforce the documented default max_clients connection limit

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

Megaco flex scanner buffer overflow via oversized property parm name

TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

httpd mod_auth directory protection bypassed by a doubled slash in the request path

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

httpc memory exhaustion via unbounded response header accumulation

Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Denial of service via exponential certificate policy tree growth in path validation

Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

epmd permanent DoS via EMFILE on accept(2) in erts

TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

An issue was discovered in Erlang/OTP before 23.2.2

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

OCSP designated-responder authorization bypass via missing signature verification

SSH daemon allocates unbounded idle session channels, bypassing max_channels

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3

uri_string does not bound the port component of a URI before integer conversion

httpc leaks Authorization header to cross-origin redirect targets

Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks

TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

httpc does not bound server-supplied numeric header values before integer conversion

inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY…

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data…