otp vulnerabilities and CVEs

Known vulnerabilities affecting otp, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

23 vulnerabilities tracked.

• 8.7 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to… CVE-2026-69664 1 Sept 2026
• 8.7 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. CVE-2026-74835 1 Sept 2026
• 8.7 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to… CVE-2026-71380 1 Sept 2026
• 8.7 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to… CVE-2026-70399 1 Sept 2026
• 8.7 Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to… CVE-2026-59251 27 Jul 2026
• 8.7 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS… CVE-2026-58227 27 Jul 2026
• 8.7 Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtlspacketdemux module) allows an unauthenticated remote… CVE-2026-55950 2 Jul 2026
• 8.3 httpd function checkheader/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112… CVE-2026-73812 1 Sept 2026
• 8.3 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. CVE-2026-73276 1 Sept 2026
• 8.3 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). CVE-2026-66357 1 Sept 2026
• 8.2 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause… CVE-2026-65634 22 Sept 2026
• 8.2 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected… CVE-2026-66835 1 Sept 2026
• 8.2 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside… CVE-2026-73270 1 Sept 2026
• 8.2 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an… CVE-2026-75538 1 Sept 2026
• 8.2 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. CVE-2026-55951 1 Sept 2026
• 8.2 The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key… CVE-2026-55952 2 Jul 2026
• 7.1 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust… CVE-2026-68956 22 Sept 2026
• 6.9 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by… CVE-2026-59696 1 Sept 2026
• 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to… CVE-2026-70409 1 Sept 2026
• 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by… CVE-2026-70405 1 Sept 2026
• 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to… CVE-2026-71562 1 Sept 2026
• 6.3 Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (sshauth, sshoptions modules) allows unauthenticated remote username… CVE-2026-48859 10 Jun 2026
• 6.0 The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory… CVE-2026-74994 1 Sept 2026