httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

httpd applies no timeout while receiving a request body, parking a worker on a stalled client

httpd does not enforce the documented default max_clients connection limit

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

Megaco flex scanner buffer overflow via oversized property parm name

TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

httpd mod_auth directory protection bypassed by a doubled slash in the request path

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

httpc memory exhaustion via unbounded response header accumulation

Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Denial of service via exponential certificate policy tree growth in path validation

Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

epmd permanent DoS via EMFILE on accept(2) in erts

TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

An issue was discovered in Erlang/OTP before 23.2.2

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

OCSP designated-responder authorization bypass via missing signature verification

SSH daemon allocates unbounded idle session channels, bypassing max_channels

SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3