Erlang OTP
64 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-96596 | 29.0 – < 29.1.2 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-105236 | ≥ 18.0 | TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-94200 | ≥ 23.3 | TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl | HIGH 8.2 | 0.5 % | ||
| CVE-2026-65634 | ≥ 17.0 | Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder | HIGH 8.2 | 0.3 % | ||
| CVE-2026-68956 | ≥ 18.1.2 | SSH daemon allocates unbounded idle session channels, bypassing max_channels | HIGH 7.1 | 0.4 % | ||
| CVE-2026-89422 | ≥ 22.2 | TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-69664 | ≥ 18.1.4 | httpd parks a request worker indefinitely on a malformed chunk size sent after the headers | HIGH 8.7 | 0.9 % | ||
| CVE-2026-70409 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | eldap does not bound the port component of a referral URL before integer conversion | MEDIUM 6.3 | 0.6 % | ||
| CVE-2026-70405 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-66835 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpd mod_auth directory protection bypassed by a doubled slash in the request path | HIGH 8.2 | 1.0 % | ||
| CVE-2026-73270 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems | HIGH 8.2 | 0.9 % | ||
| CVE-2026-75538 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer | HIGH 8.2 | 0.9 % | ||
| CVE-2026-74994 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth | MEDIUM 6.0 | 0.6 % | ||
| CVE-2026-74835 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception | HIGH 8.7 | 0.6 % | ||
| CVE-2026-73812 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length | HIGH 8.3 | 0.5 % | ||
| CVE-2026-73276 | 22.2 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i | HIGH 8.3 | 0.6 % | ||
| CVE-2026-66357 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation | HIGH 8.3 | 0.6 % | ||
| CVE-2026-59696 | 21.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | uri_string does not bound the port component of a URI before integer conversion | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-55951 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpc memory exhaustion via unbounded response header accumulation | HIGH 8.2 | 0.7 % | ||
| CVE-2026-71380 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpd applies no timeout while receiving a request body, parking a worker on a stalled client | HIGH 8.7 | 0.7 % | ||
| CVE-2026-71562 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpc does not bound server-supplied numeric header values before integer conversion | MEDIUM 6.3 | 0.6 % | ||
| CVE-2026-70399 | 17.0 – < 27.3.4.17 ; 28.0 – < 28.5.0.6 ; 29.0 – < 29.0.6 | httpd does not enforce the documented default max_clients connection limit | HIGH 8.7 | 0.9 % | ||
| CVE-2026-54890 | ≥ 15.0 | BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding | HIGH 8.2 | 0.4 % | ||
| CVE-2026-59251 | ≥ 1.15 | Denial of service via exponential certificate policy tree growth in path validation | HIGH 8.7 | 0.3 % | ||
| CVE-2026-59250 | 17.0 – < 27.3.4.15 ; 28.0 – < 28.5.0.4 ; 29.0 – < 29.0.4 | Megaco flex scanner buffer overflow via oversized property parm name | HIGH 8.3 | 0.8 % | ||
| CVE-2026-55953 | 17.0 – < 27.3.4.15 ; 28.0 – < 28.5.0.4 ; 29.0 – < 29.0.4 | TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-55737 | ≥ 13.0 | Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-47078 | ≥ 27.1 | Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-42792 | ≥ 6.0 | epmd permanent DoS via EMFILE on accept(2) in erts | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-58227 | ≥ 10.2 | TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain | HIGH 8.7 | 0.4 % | ||
| CVE-2026-54891 | 17.0 – < 27.3.4.14 ; 28.0 – < 28.5.0.3 ; 29.0 – < 29.0.3 | Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-55950 | ≥ 10.9 | DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions | HIGH 8.7 | 0.4 % | ||
| CVE-2026-54886 | ≥ 3.0.1 | SSH SFTP server denial of service via extended channel data infinite loop | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-55952 | ≥ 9.5 | TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension | HIGH 8.2 | 0.5 % | ||
| CVE-2026-54887 | ≥ 8.2 | DTLS server cookie bypass during startup window due to empty initial cookie secret | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-53422 | ≥ 3.0.1 | SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root | LOW 2.3 | 0.3 % | ||
| CVE-2026-48856 | ≥ 17.0 | httpc leaks Authorization header to cross-origin redirect targets | HIGH 7.1 | 0.3 % | ||
| CVE-2026-48860 | ≥ 26.0 | Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist | HIGH 7.5 | 0.2 % | ||
| CVE-2026-48855 | ≥ 17.0 | SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured | LOW 2.3 | 0.3 % | ||
| CVE-2026-48858 | 5.10.4 – < 7.0 | ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-48859 | 29.0 – < 29.0.2 | SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-49759 | ≥ 17.0 | Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash | HIGH 8.8 | 0.5 % | ||
| CVE-2026-49760 | ≥ 17.0 | Stack Buffer Overflow in ei_s_print_term at Very Large Integer | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-42790 | ≥ 1.4 | nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification | HIGH 7.6 | 0.3 % | ||
| CVE-2026-42791 | ≥ 1.16 | OCSP responder certificate validity period not checked in public_key | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-42789 | ≥ 17.0 | Non-CA certificate accepted as intermediate issuer in public_key path validation | HIGH 7.0 | 0.4 % | ||
| CVE-2026-32147 | ≥ 3.01 | SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-28808 | ≥ 17.0 | ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) | HIGH 8.3 | 0.6 % | ||
| CVE-2026-32144 | ≥ 1.16 | OCSP designated-responder authorization bypass via missing signature verification | HIGH 7.6 | 0.2 % | ||
| CVE-2026-28810 | ≥ 3.0 | Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-23941 | ≥ 5.10 | Request smuggling via first-wins Content-Length parsing in inets httpd | HIGH 7.0 | 0.5 % | ||
| CVE-2026-23943 | ≥ 3.0.1 | Pre-auth SSH DoS via unbounded zlib inflate | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-23942 | ≥ 3.0.1 | SFTP root escape via component-agnostic prefix check in ssh_sftpd | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-21620 | ≥ 17.0 ; ≥ 07b8f441ca711f9812fad9e9115bab3c3aa92f79 | TFTP Path Traversal | LOW 2.3 | 0.5 % | ||
| CVE-2025-48041 | ≥ 3.0.1 | SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles | HIGH 7.1 | 0.4 % | ||
| CVE-2025-48040 | ≥ 3.0.1 | Malicious Key Exchange Messages may Lead to Excessive Resource Consumption | MEDIUM 6.9 | 0.5 % | ||
| CVE-2025-48039 | ≥ 3.0.1 | Unverified Paths can Cause Excessive Use of System Resources | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-48038 | ≥ 3.0.1 | Unverified File Handles can Cause Excessive Use of System Resources | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-4748 | ≥ 2.0 | Absolute path traversal in zip:unzip/1,2 | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-46712 | >= OTP 27.0, < OTP 27.3.4 ; >= OTP 26.2.1, < OTP 26.2.5.12 ; < OTP 25.3.2.21 | Erlang/OTP SSH Has Strict KEX Violations | LOW 3.7 | 0.5 % | ||
| CVE-2025-32433 | >= OTP-27.0-rc1, < OTP-27.3.3 ; >= OTP-26.0-rc1, < OTP-26.2.5.11 ; < OTP-25.3.2.20 | Erlang/OTP SSH Vulnerable to Pre-Authentication RCE | CRITICAL 10.0 | 99 % | KEV | |
| CVE-2025-30211 | < OTP-27.3.1 ; < OTP-26.2.5.10 ; < OTP-25.3.2.19 | KEX init error results with excessive memory usage | HIGH 7.5 | 0.5 % | ||
| CVE-2025-26618 | >= OTP-27.0.0, < OTP-27.2.4 ; >= OTP-26.0.0.0, < OTP-26.2.5.9 ; < OTP-25.3.2.18 | SSH SFTP packet size not verified properly in Erlang OTP | HIGH 7.0 | 0.5 % | ||
| CVE-2024-53846 | >= 25.3.2.8, <= 25.3.2.16 ; >= 26.2, <= 26.2.5.6 ; >= 27.0, <= 27.1.3 | ssl fails to validate incorrect extened key usage | MEDIUM 5.5 | 0.3 % |