SB20260902111 - Multiple vulnerabilities in Erlang OTP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260902111

SB20260902111 - Multiple vulnerabilities in Erlang OTP

Published: September 2, 2026

Security Bulletin ID SB20260902111
CSH Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 19% Medium 75% Low 6%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70399)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the inets httpd server when accepting simultaneous connections. A remote attacker can open a large number of connections and keep them open to cause a denial of service.

Only servers using the default configuration without an explicitly set max_clients value are vulnerable, and no valid request or user interaction is required.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-74835)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the inets httpd server request body handling when processing chunked request bodies with Transfer-Encoding: chunked. A remote attacker can send a request that announces a very large chunk size and continuously stream body data without completing the chunk to cause a denial of service.

Only servers that configure max_body_size to a finite value are vulnerable; default configurations using nolimit are not considered vulnerable.


3) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-69664)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of resource after effective lifetime in the inets httpd chunked request body handling when processing a chunked request body with a malformed chunk size sent after the headers have already been accepted. A remote attacker can send a specially crafted chunked HTTP request and keep the connection open to cause a denial of service.

The malformed chunk-size line must be delivered in a separate write after the headers are processed; if it arrives together with the headers, the server rejects the request. No special configuration is required, and the issue is reachable in the default configuration.


4) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-70405)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the snmp BER INTEGER decoder and manager-side logging path when processing untrusted SNMP input containing arbitrarily large integers. A remote attacker can send specially crafted input to cause a denial of service.

The issue involves unbounded integer conversion and rendering of decoded bignums, and the render path runs inside a non-yielding C BIF that can occupy a dirty scheduler thread for the full conversion.


5) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-70409)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the eldap referral-URL port parsing logic when processing a referral URL from a malicious LDAP server. A remote attacker can provide a referral URL with an excessively large decimal port value to cause a denial of service.

The issue involves unbounded conversion between textual decimal representations and arbitrary-precision integers, and the rendering path performs the conversion inside a non-yielding C BIF.


6) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-71562)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the httpc Content-Length handling in httpc_handler.erl when parsing a server-supplied Content-Length header. A remote attacker can supply a specially crafted Content-Length value to cause a denial of service.

The issue occurs because the Content-Length value is parsed before the size check, and the default max_header_size setting is nolimit.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-75538)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow caused by signed integer overflow in the inet TCP driver when processing TCP packets in {packet,4} mode. A remote attacker can send a specially crafted packet with an incorrect length value to cause a denial of service.

Only TCP ports using the inet driver with {packet,4} mode are affected.


8) Path Equivalence: \'//multiple/leading/slash\' (CVE-ID: CVE-2026-66835)

CWE-ID: CWE-50 - Path Equivalence: \'//multiple/leading/slash\'

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose protected files.

The vulnerability exists due to path equivalence handling in inets httpd mod_auth directory protection when processing request paths with repeated leading slashes. A remote attacker can send a specially crafted request with an extra slash in the path to disclose protected files.

This requires an inets httpd deployment that enforces mod_auth on a directory block.


9) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-73270)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access protected resources.

The vulnerability exists due to improper handling of case sensitivity in the mod_auth module in OTP\'s inets httpd server when processing requests for protected directory paths on case-insensitive filesystems. A remote attacker can request the same protected resource using different path casing to bypass authentication and access protected resources.

Only deployments on case-insensitive filesystems such as Windows and macOS are vulnerable, and exploitation requires one or more directory blocks configured with mod_auth.


10) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-71380)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of resource after effective lifetime in httpd_request_handler.erl when receiving an HTTP request body after successfully parsing headers. A remote attacker can send valid HTTP headers with a large Content-Length value, transmit a small amount of body data, and then stall the connection to cause a denial of service.

The issue affects httpd in its default configuration when minimum_bytes_per_second is false, allowing stalled connections to hold worker slots indefinitely.


11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73276)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing malformed HTTP headers with whitespace before the colon behind a lenient reverse proxy. A remote attacker can send a specially crafted request to smuggle HTTP requests.

Exploitation requires the server to be deployed behind a reverse proxy that accepts headers containing whitespace before the colon and forwards the request body.


12) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-66357)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server header parser when handling HTTP requests containing obs-fold header continuation lines. A remote attacker can send a specially crafted request to smuggle HTTP requests.

Exploitation requires the server to be deployed behind a reverse proxy that merges obs-fold continuation lines with the preceding header.


13) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73812)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing requests containing both Transfer-Encoding: chunked and Content-Length headers behind a reverse proxy that prefers Content-Length. A remote attacker can send a specially crafted request to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.

Exploitation requires httpd to be deployed behind a reverse proxy that processes Content-Length preferentially over Transfer-Encoding.


14) Incorrect authorization (CVE-ID: CVE-2026-74994)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass directory-specific authorization controls.

The vulnerability exists due to incorrect authorization in the mod_auth module when processing authentication for multiple directory configuration blocks with dets or mnesia backends. A remote user can use valid credentials for one protected path to access other protected paths on the same httpd instance to bypass directory-specific authorization controls.

Only deployments configured with dets or mnesia authentication backends and two or more directory blocks with different require_user or require_group settings are vulnerable. Deployments using the plain authentication backend or a single directory block are not affected.


15) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-55951)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the httpc HTTP client when processing HTTP response headers from a server. A remote attacker can send an HTTP response with an arbitrarily large number of headers or very large header values to cause a denial of service.

This affects applications using httpc:request/4,5 to connect to untrusted servers.


16) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-59696)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in stdlib integer conversion functions and uri_string:parse/1 when processing untrusted URL input or converting unbounded textual decimal representations and arbitrary-precision integers. A remote attacker can send a specially crafted input to cause a denial of service.

The render path performs integer string conversion inside a non-yielding C BIF, which can occupy a dirty scheduler thread for the full conversion, while the parse path is preemptible but can still consume significant processing time with extremely large inputs.


Remediation

Install update from vendor's website.

References