Login Request a demo
ER
Vendor
Erlang
12 products with CVEs on record
101
CVEs
2
On KEV
6
New 30D
Products
OT
OTP
Erlang
10.0
65 CVEs1 on KEV3 new
RE
rebar3
erlang
9.8
6 CVEs0 on KEV3 new
OT
otp
erlang
10.0
1 CVEs1 on KEV0 new
ER
Erlang/ssl
Erlang
7.5
8 CVEs0 on KEV0 new
ER
Erlang/ssh
Erlang
6.5
7 CVEs0 on KEV0 new
ER
Erlang/inets
Erlang
9.8
4 CVEs0 on KEV0 new
ER
Erts
Erlang
8.2
4 CVEs0 on KEV0 new
EK
Erlang/public Key
Erlang
7.5
2 CVEs0 on KEV0 new
CR
Crypto
Erlang
–
1 CVEs0 on KEV0 new
EI
Erl Interface
Erlang
5.5
1 CVEs0 on KEV0 new
ER
Erlang
Erlang
7.5
1 CVEs0 on KEV0 new
FT
Ftp
Erlang
6.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-96596
RE
rebar3
erlang
5.9
0%
Oct 14erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
CVE-2026-105236
OT
OTP
Erlang
6.3
0%
Oct 14TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries
CVE-2026-94200
OT
OTP
Erlang
8.2
0%
Oct 14TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
CVE-2026-105274
RE
rebar3
erlang
2.1
0%
Oct 12hex_core decompresses registry and Erlang term API responses without size limits
CVE-2026-103060
RE
rebar3
erlang
7.5
0%
Oct 12Path traversal in rebar3 via unvalidated dependency app names
CVE-2026-65634
OT
OTP
Erlang
8.2
0%
Sep 22Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
CVE-2026-68956
OT
OTP
Erlang
7.1
0%
Sep 22SSH daemon allocates unbounded idle session channels, bypassing max_channels
CVE-2026-89422
OT
OTP
Erlang
9.3
0%
Sep 22TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
CVE-2026-69664
OT
OTP
Erlang
8.7
1%
Sep 1httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-70409
OT
OTP
Erlang
6.3
1%
Sep 1eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-70405
OT
OTP
Erlang
6.3
1%
Sep 1snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-66835
OT
OTP
Erlang
8.2
1%
Sep 1httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270
OT
OTP
Erlang
8.2
1%
Sep 1httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
CVE-2026-75538
OT
OTP
Erlang
8.2
1%
Sep 1A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
CVE-2026-74994
OT
OTP
Erlang
6.0
1%
Sep 1inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
CVE-2026-74835
OT
OTP
Erlang
8.7
1%
Sep 1inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-73812
OT
OTP
Erlang
8.3
1%
Sep 1inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276
OT
OTP
Erlang
8.3
1%
Sep 1inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-66357
OT
OTP
Erlang
8.3
1%
Sep 1inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-59696
OT
OTP
Erlang
6.9
1%
Sep 1uri_string does not bound the port component of a URI before integer conversion
CVE-2026-55951
OT
OTP
Erlang
8.2
1%
Sep 1httpc memory exhaustion via unbounded response header accumulation
CVE-2026-71380
OT
OTP
Erlang
8.7
1%
Sep 1httpd applies no timeout while receiving a request body, parking a worker on a stalled client
CVE-2026-71562
OT
OTP
Erlang
6.3
1%
Sep 1httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70399
OT
OTP
Erlang
8.7
1%
Sep 1httpd does not enforce the documented default max_clients connection limit
CVE-2026-54890
OT
OTP
Erlang
7.5
0%
Jul 27BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
CVE-2026-59251
OT
OTP
Erlang
7.5
0%
Jul 27Denial of service via exponential certificate policy tree growth in path validation
CVE-2026-59250
OT
OTP
Erlang
8.3
1%
Jul 27Megaco flex scanner buffer overflow via oversized property parm name
CVE-2026-55953
OT
OTP
Erlang
7.4
0%
Jul 27TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
CVE-2026-55737
OT
OTP
Erlang
7.5
0%
Jul 27Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
CVE-2026-47078
OT
OTP
Erlang
4.8
0%
Jul 27Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
CVE-2026-42792
OT
OTP
Erlang
7.5
0%
Jul 27epmd permanent DoS via EMFILE on accept(2) in erts
CVE-2026-58227
OT
OTP
Erlang
7.5
0%
Jul 27TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
CVE-2026-54891
OT
OTP
Erlang
3.7
0%
Jul 2Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl
CVE-2026-55950
OT
OTP
Erlang
5.9
0%
Jul 2DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions
CVE-2026-54886
OT
OTP
Erlang
4.3
0%
Jul 2SSH SFTP server denial of service via extended channel data infinite loop
CVE-2026-55952
OT
OTP
Erlang
7.5
0%
Jul 2TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension
CVE-2026-54887
OT
OTP
Erlang
4.8
0%
Jul 2DTLS server cookie bypass during startup window due to empty initial cookie secret
CVE-2026-53422
OT
OTP
Erlang
4.3
0%
Jul 2SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
CVE-2026-48856
OT
OTP
Erlang
6.5
0%
Jun 10httpc leaks Authorization header to cross-origin redirect targets
CVE-2026-48860
OT
OTP
Erlang
6.5
0%
Jun 10Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
CVE-2026-48855
OT
OTP
Erlang
6.5
0%
Jun 10SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
CVE-2026-48858
OT
OTP
Erlang
6.5
0%
Jun 10ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
CVE-2026-48859
OT
OTP
Erlang
5.3
0%
Jun 10SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration
CVE-2026-49759
OT
OTP
Erlang
8.2
0%
Jun 10Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
CVE-2026-49760
OT
OTP
Erlang
5.5
0%
Jun 10Stack Buffer Overflow in ei_s_print_term at Very Large Integer
CVE-2026-42790
OT
OTP
Erlang
8.1
0%
May 27nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification
CVE-2026-42791
OT
OTP
Erlang
3.7
0%
May 27OCSP responder certificate validity period not checked in public_key
CVE-2026-42789
OT
OTP
Erlang
4.8
0%
May 27Non-CA certificate accepted as intermediate issuer in public_key path validation
CVE-2026-32147
OT
OTP
Erlang
4.3
0%
Apr 21SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
CVE-2026-28808
OT
OTP
Erlang
9.8
1%
Apr 7ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
CVE-2026-32144
OT
OTP
Erlang
7.4
0%
Apr 7OCSP designated-responder authorization bypass via missing signature verification
CVE-2026-28810
OT
OTP
Erlang
3.7
0%
Apr 7Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
CVE-2026-23943
ER
Erlang/ssh
Erlang
5.3
1%
Mar 13Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion
CVE-2026-23942
ER
Erlang/otp
Erlang
5.4
0%
Mar 13Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal
CVE-2026-23941
ER
Erlang/inets
Erlang
9.4
0%
Mar 13Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling
CVE-2026-21619
RE
Rebar3
Erlang
7.5
1%
Feb 27Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api…
CVE-2025-32433
In wildKEV
OT
otp
erlang
10.0
99%
Apr 16Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
CVE-2023-48795
ER
Erlang/otp
Erlang
5.9
94%
Dec 18The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…
CVE-2022-37026
ER
Erlang/otp
Erlang
9.8
1%
Sep 21In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and…
CVE-2021-29221
ER
Erlang/otp
Erlang
7.0
1%
Apr 9A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3