What’s Vulnerable › Products
Erlang OTP vulnerabilities
74 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 61 published in the last 12 months.
Check whether your Erlang OTP version is affected
Exploited Erlang OTP vulnerabilities
- CVE-2025-32433 — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Latest Erlang OTP vulnerabilities
- CVE-2026-96596 — erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole (CVSS 5.9)
- CVE-2026-94200 — TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl (CVSS 8.2)
- CVE-2026-105236 — TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries (CVSS 6.3)
- CVE-2026-89422 — TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension (CVSS 9.3)
- CVE-2026-68956 — SSH daemon allocates unbounded idle session channels, bypassing max_channels (CVSS 7.1)
- CVE-2026-65634 — Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder (CVSS 8.2)
- CVE-2026-75538 — A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer (CVSS 8.2)
- CVE-2026-74994 — inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (CVSS 6.0)
- CVE-2026-74835 — inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception (CVSS 8.7)
- CVE-2026-73812 — inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length (CVSS 8.3)
- CVE-2026-73276 — inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i (CVSS 8.3)
- CVE-2026-73270 — httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems (CVSS 8.2)
- CVE-2026-71562 — httpc does not bound server-supplied numeric header values before integer conversion (CVSS 6.3)
- CVE-2026-71380 — httpd applies no timeout while receiving a request body, parking a worker on a stalled client (CVSS 8.7)
- CVE-2026-70409 — eldap does not bound the port component of a referral URL before integer conversion (CVSS 6.3)
- CVE-2026-70405 — snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields (CVSS 6.3)
- CVE-2026-70399 — httpd does not enforce the documented default max_clients connection limit (CVSS 8.7)
- CVE-2026-69664 — httpd parks a request worker indefinitely on a malformed chunk size sent after the headers (CVSS 8.7)
- CVE-2026-66835 — httpd mod_auth directory protection bypassed by a doubled slash in the request path (CVSS 8.2)
- CVE-2026-66357 — inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation (CVSS 8.3)
- CVE-2026-59696 — uri_string does not bound the port component of a URI before integer conversion (CVSS 6.9)
- CVE-2026-55951 — httpc memory exhaustion via unbounded response header accumulation (CVSS 8.2)
- CVE-2026-59251 — Denial of service via exponential certificate policy tree growth in path validation (CVSS 7.5)
- CVE-2026-59250 — Megaco flex scanner buffer overflow via oversized property parm name (CVSS 8.3)
- CVE-2026-58227 — TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (CVSS 7.5)