erlang otp vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20259
3. 202654

Known exploitedNewest addition to KEV first

• CVE-2025-32433

  Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

  erlang · otp

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-96596

  erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

  erlang · rebar3

  Medium5.9
• CVE-2026-105236

  TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries

  Erlang · OTP

  Medium6.3
• CVE-2026-94200

  TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

  Erlang · OTP

  High8.2
• CVE-2026-65634

  Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

  Erlang · OTP

  High8.2
• CVE-2026-68956

  SSH daemon allocates unbounded idle session channels, bypassing max_channels

  Erlang · OTP

  High7.1
• CVE-2026-89422

  TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

  Erlang · OTP

  Critical9.3
• CVE-2026-69664

  httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

  Erlang · OTP

  High8.7
• CVE-2026-70409

  eldap does not bound the port component of a referral URL before integer conversion

  Erlang · OTP

  Medium6.3
• CVE-2026-70405

  snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

  Erlang · OTP

  Medium6.3
• CVE-2026-66835

  httpd mod_auth directory protection bypassed by a doubled slash in the request path

  Erlang · OTP

  High8.2