49 matches found
CVE-2026-103502
The hex_core library (versions 0.1.0 before 0.20.0 ) contains an Improper Certificate Validation vulnerability. When using the default HTTP adapter on Erlang/OTP 24 or OTP 25 (specifically when CA certificates cannot be loaded), the library fails to verify server certificates for HTTPS requests. ...
PT-2026-110581
Name of the Vulnerable Software and Affected Versions hex core versions 0.1.0 through 0.19.9 Description Improper certificate validation in hex core allows an attacker capable of intercepting HTTPS connections to impersonate hex.pm, repo.hex.pm, or other repository and API servers. This occurs wh...
Security Bulletin: erlang
Summary This entire batch of CVEs represents a coordinated vulnerability disclosure for Erlang/OTP, affecting components within the built-in inets httpc / httpd application and the snmp library. Vulnerability Details CVEID:CVE-2026-55951 DESCRIPTION: The Erlang/OTP httpc HTTP client does not...
Security Bulletin: erlang-OTP
Summary It is a memory exhaustion denial-of-service vulnerability in the Erlang/OTP httpc HTTP client Vulnerability Details CVEID:CVE-2026-55951 DESCRIPTION: The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize...
OESA-2026-4133 erlang security update
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: The Erlang/OTP httpc HTTP client does not enforce a lim...
OESA-2026-4132 erlang security update
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: The Erlang/OTP httpc HTTP client does not enforce a lim...
OESA-2026-4131 erlang security update
Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: The Erlang/OTP httpc HTTP client does not enforce a lim...
httpc does not bound server-supplied numeric header values before integer conversion
...
httpc memory exhaustion via unbounded response header accumulation
...
Linux Distros Unpatched Vulnerability : CVE-2026-55951
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to...
SUSE CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
SUSE CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
AZL-98454 CVE-2026-55951 affecting package erlang for versions less than 26.2.5.21-6
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
DEBIAN-CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
UBUNTU-CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...
CVE-2026-55951
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...