CVE-2026-96596: Loop with Unreachable Exit Condition

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP stdlib erltar module, hexpm hexcore hexerltar module, hexpm hex mixhexerltar module and erlang rebar3 r3hexerltar module allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU...

CVE-2026-94200: Improper Validation of Consistency within Input

Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl tlshandshake13, sslhandshake and tlsclientticketstore modules allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a...

PT-2026-113981

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.0 through 27.3.4.18 Erlang/OTP versions 28.0 through 28.5.0.7 Erlang/OTP versions 29.0 through 29.1.1 ssl versions 7.0 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7 Descriptio...

PT-2026-114358

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 29.0 through 29.1.1 stdlib versions 8.0 through 8.1.0 hex versions 2.4.2 through 2.5.2 hex core versions 0.14.0 through 0.20.0 rebar3 versions 3.27.1 and later Description An infinite loop issue exists in the erl tar module...

PT-2026-114353

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 23.3 through 27.3.4.18 Erlang OTP versions 28.0 through 28.5.0.7 Erlang OTP versions 29.0 through 29.1.1 ssl versions 10.3 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7 Descripti...

Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp

The Erlang/OTP project reports: OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues, three of which complete earlier incomplete fixes: CVE-2026-105236: DTLS-1.2 session resumption could cross SNI virtual-host boundaries. An SNI-aware server resumed a cached session even when the resumptio...

Erlang/OTP -- erl_tar denial of service via crafted GNU sparse member

https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382 reports: A loop with unreachable exit condition 'infinite loop' vulnerability in the erltar module allowed an attacker who supplied a tar archive to cause a denial of service via a crafted GNU sparse member with a trailing hole...

CVE-2026-84360

The Nginx UI web interface for the Nginx web server is vulnerable to an authentication bypass in versions prior to 2.4.1 . The root cause is that while HTTP configuration mutation routes require RequireSecureSession , the /mcp and /mcp_message endpoints only require ordinary authentication. This ...

CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84360 Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.5.0 , the application fails to apply the RequireSecureSession middleware to several sensitive mutation routes, including the api/cluster router. This allows an authenticated user with a stolen or persisted JWT to bypass...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-103502

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

CVE-2026-103502

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

EUVD-2026-97450

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...