erlang vulnerabilities
Every vulnerability this feed holds for erlang, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
24 vulnerabilities tracked.
- 8.7 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to…
- 8.7 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.
- 8.7 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to…
- 8.7 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to…
- 8.7 Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to…
- 8.7 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS…
- 8.7 Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtlspacketdemux module) allows an unauthenticated remote…
- 8.3 httpd function checkheader/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112…
- 8.3 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
- 8.3 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines).
- 8.2 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause…
- 8.2 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected…
- 8.2 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside…
- 8.2 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an…
- 8.2 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server.
- 8.2 The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key…
- 7.1 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust…
- 6.9 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by…
- 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to…
- 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by…
- 6.3 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to…
- 6.3 Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (sshauth, sshoptions modules) allows unauthenticated remote username…
- 6.0 The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory…
- 2.1 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hexcore allows an untrusted repository mirror, or a…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that erlang is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Microsoft Linux Red Hat IBM n/a Apple Google Apache Software Foundation Oracle Corporation zephyrproject Unknown FFMPEG Adobe Drupal SAP_SE Cisco Eclipse Foundation OpenEMR go-vikunja hickory-dns n8n-io Hitachi Grafana HCL Software