Skip to content
OpenAdvisories
Medium WID-SEC-2026-3146 16 CVEs

Erlang/OTP: Mehrere Schwachstellen

Published Sep 1, 2026 · Updated Nov 2, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: Fedora Vendor: Microsoft Vendor: Ubuntu Product: Azure Linux Product: Linux Product: Linux Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Erlang/OTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Erlang/OTP (Open Telecom Platform) ist eine Sammlung von Bibliotheken und Tools, die auf der Programmiersprache Erlang basieren und für den Aufbau skalierbarer, fehlertoleranter und verteilter Systeme entwickelt wurden.

Vulnerabilities 16

  • High 8.7
    CVE-2026-69664

    httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

    Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The w…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-70399

    httpd does not enforce the documented default max_clients connection limit

    Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented t…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-71380

    httpd applies no timeout while receiving a request body, parking a worker on a stalled client

    Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-74835

    inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

    The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-66357

    inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

    httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request …

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-73276

    inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

    Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.3
    CVE-2026-73812

    inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

    httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length.…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-55951

    httpc memory exhaustion via unbounded response header accumulation

    The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length c…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-66835

    httpd mod_auth directory protection bypassed by a doubled slash in the request path

    Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI wi…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-73270

    httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

    Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insens…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2026-75538

    A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

    An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.9
    CVE-2026-59696

    uri_string does not bound the port component of a URI before integer conversion

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri_string:get_port/1 passes the port substring to bin…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-70405

    snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 def…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-70409

    eldap does not bound the port component of a referral URL before integer conversion

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-71562

    httpc does not bound server-supplied numeric header values before integer conversion

    Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc_handler.erl converts…

    Erlang Project OTP erlang Azure Linux
  • Medium 6.0
    CVE-2026-74994

    inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

    The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected d…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

Revision history

  1. #6

    Neue Updates von Fedora aufgenommen

  2. #5

    Neue Updates von Debian aufgenommen

  3. #4

    Neue Updates von Fedora aufgenommen

  4. #3

    Neue Updates von Ubuntu aufgenommen

  5. #2

    Neue Updates aufgenommen

  6. #1

    Initiale Fassung

References