erlang rebar3
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-96596 | 3.27.1 – < 3.28.0 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-105274 | 3.9.1 – < 3.27.3 | hex_core decompresses registry and Erlang term API responses without size limits | LOW 2.1 | 0.4 % | ||
| CVE-2026-103060 | 3.7.0-rc1 – < 3.27.2 | Path traversal in rebar3 via unvalidated dependency app names | HIGH 7.5 | 0.5 % | ||
| CVE-2026-21619 | 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 – < 1d4478f527e373de0b225951e53115450e0d9b9d | Unsafe Deserialization of Erlang Terms in hex_core | LOW 2.0 | 0.6 % |