cowboy: Cowboy: Denial of Service via HTTP/1.1 duplicate header names

A flaw was found in Cowboy. An unauthenticated remote attacker can exploit this vulnerability by sending multiple HTTP/1.1 header lines with the same name. This bypasses the maxheaders limit, causing the connection process memory to grow uncontrollably. This can lead to memory exhaustion and a...

CVE-2026-53422 affecting package erlang for versions less than 26.2.5.21-5

CVE-2026-53422 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...

CVE-2026-55950 affecting package erlang for versions less than 26.2.5.21-5

CVE-2026-55950 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...

CVE-2026-54887 affecting package erlang for versions less than 26.2.5.21-5

CVE-2026-54887 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...

CVE-2026-59250 affecting package erlang for versions less than 26.2.5.21-5

CVE-2026-59250 affecting package erlang for versions less than 26.2.5.21-5. A patched version of the package is available...

CVE-2026-44725

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

EUVD-2026-63381

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

CVE-2026-59250

A flaw was found in the Erlang/OTP megaco flex scanner C driver. A remote, unauthenticated attacker can exploit a buffer overflow vulnerability by sending a specially crafted H.248/Megaco message with an oversized property parameter name. This can lead to memory corruption, potentially allowing f...

EUVD-2026-36235

membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

CVE-2026-54886 affecting package erlang for versions less than 26.2.5.21-4

CVE-2026-54886 affecting package erlang for versions less than 26.2.5.21-4. A patched version of the package is available...

SonicWall SMA1000 Server-Side Request Forgery / Remote Command Execution

This Metasploit module exploits a server-side request forgery vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to...

Astra Linux – Vulnerability in Erlang

An incorrect authorization vulnerability exists in Erlang OTP inets modules, allowing unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside of DocumentRoot, modauth evaluates directory-based access...

Astra Linux – Vulnerability in Erlang

Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in Erlang OTP inets httpd module allows for HTTP requests to be disguised. This vulnerability is associated with the program file lib/inets/src/httpserver/httpdrequest.erl and the routine...

Photon OS 5.0: Erlang PHSA-2025-5.0-91-0505

An update of the erlang package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0505. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-69659

CVE-2026-69659 affects ash-project Ash, specifically the keyset pagination cursor handling in Ash.Page.Keyset. Read actions using keyset pagination deserialize client-supplied page[:after] or page[:before] by base64 decoding the cursor and passing it to Erlang :erlang.binary_to_term/2 without siz...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

[SECURITY] Fedora 44 Update: erlang-26.2.5.21-5.fc44

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson...

[SECURITY] Fedora 43 Update: erlang-26.2.5.21-5.fc43

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson...