DEBIAN-CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

AZL-98472 CVE-2026-70405 affecting package erlang for versions less than 26.2.5.21-6

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

EUVD-2026-69246

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

EEF-CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

Summary Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity,...

CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-70405

CVE-2026-70405 is an improper input validation vulnerability in the Erlang/OTP snmp module. The function snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, causing do_dec_integer_notag/2 to accumulate a BER INTEGER value via recursive shift-and-or operations whose cost grows super...

CVE-2026-70405

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-84193

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84191

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84193

LibreNMS through version 26.2.0 is affected by a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields , including BGP peer descriptions, VRF names, process information, and SLA tags. An attacker with device management access o...

CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

EUVD-2026-69030

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP interface descriptions and syslog program fields without proper escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript that executes when aut...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...