1870 matches found
Erlang/OTP -- remote crash via gen_tcp with {packet,4}
The OTP 29.0.6 release notes report: A gentcp socket using the inet driver and packet,4 had a bug if receiving a packet with size just below INTMAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent blocks...
EEF-CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc
Summary Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token ...
[SECURITY] [DSA 6464-1] erlang security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6464-1 [email protected] https://www.debian.org/security/ Aron Xu August 25, 2026 https://www.debian.org/security/faq -...
Astra Linux – Vulnerability in Erlang
There is a vulnerability in the validation of certificates in the Erlang OTP publickey pubkeyocsp module, which allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. The OCSP response verification in pubkeyocsp:verifyresponse/5 and...
Astra Linux – Vulnerability in Erlang
Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in Erlang OTP inets httpd module allows for HTTP requests to be disguised. This vulnerability is associated with the program file lib/inets/src/httpserver/httpdrequest.erl and the routine...
Astra Linux – Vulnerability in Erlang
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19, a maliciously formed KEX init message could result in high memory usage. The implementation does not verify the RFC specified limits on the length of algorithm nam...
erlang-28.5.0.4-1.1 on GA media (moderate)
erlang-28.5.0.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:11559-1 Rating: moderate Cross-References: CVE-2026-28808 CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792 CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858 CVE-2026-48860 CVE-2026-49759 CVE-2026-49760...
The vulnerability of the Erlang programming language, related to incorrect authorization, allows attackers to gain access to confidential data and influence its integrity.
The vulnerability of the Erlang programming language is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data and influence its integrity...
cowboy: Cowboy: Denial of Service via HTTP/1.1 duplicate header names
A flaw was found in Cowboy. An unauthenticated remote attacker can exploit this vulnerability by sending multiple HTTP/1.1 header lines with the same name. This bypasses the maxheaders limit, causing the connection process memory to grow uncontrollably. This can lead to memory exhaustion and a...
CVE-2026-55950 affecting package erlang for versions less than 26.2.5.21-5
CVE-2026-55950 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...
CVE-2026-53422 affecting package erlang for versions less than 26.2.5.21-5
CVE-2026-53422 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...
CVE-2026-54887 affecting package erlang for versions less than 26.2.5.21-5
CVE-2026-54887 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...
CVE-2026-59250 affecting package erlang for versions less than 26.2.5.21-5
CVE-2026-59250 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...
CVE-2026-44725
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
EUVD-2026-63381
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
CVE-2026-59250
A flaw was found in the Erlang/OTP megaco flex scanner C driver. A remote, unauthenticated attacker can exploit a buffer overflow vulnerability by sending a specially crafted H.248/Megaco message with an oversized property parameter name. This can lead to memory corruption, potentially allowing f...
EUVD-2026-36235
membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...
erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation
A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...
erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing
A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...