CVE-2026-70409— eldap does not bound the port component of a referral URL before integer conversion
Quick assessment
Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Erlang/OTP 中 eldap 组件存在输入指定数量校验不当的漏洞，使得恶意或已被攻陷的 LDAP 服务器可以通过返回一个端口部分为极长数字串的引用 URL 来降低系统可用性。 具体机制如下： 将端口子字符串直接传递给 ，且未对输入长度进行限制。 周围的 仅拒绝无法解析的值。因此，一个语法上有效、长度可达约 126 万位的端口数字串可以成功转换，但每次处理一个引用（referral）时，调用方需耗费数百毫秒执行任意精度算术运算。 由于该转换函数文档明确说明其可接受任意大小的整数，因此限制输入长度的责任在于调用
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-70409
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
eldap does not bound the port component of a referral URL before integer conversion
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits.
eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-70409
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70409
请登录查看更多情报信息。
Other References for CVE-2026-70409 (3)
Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total
| CVE-2026-71380 | 8.7 HIGH | httpd applies no timeout while receiving a request body, parking a worker on a stalled cli |
| CVE-2026-70399 | 8.7 HIGH | httpd does not enforce the documented default max_clients connection limit |
| CVE-2026-74835 | 8.7 HIGH | inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception |
| CVE-2026-69664 | 8.7 HIGH | httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
| CVE-2026-66357 | 8.3 HIGH | inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation |
| CVE-2026-73812 | 8.3 HIGH | inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length |
| CVE-2026-73276 | 8.3 HIGH | inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i |
| CVE-2026-55951 | 8.2 HIGH | httpc memory exhaustion via unbounded response header accumulation |
| CVE-2026-75538 | 8.2 HIGH | A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into |
| CVE-2026-66835 | 8.2 HIGH | httpd mod_auth directory protection bypassed by a doubled slash in the request path |
| CVE-2026-73270 | 8.2 HIGH | httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi |
| CVE-2026-59696 | 6.9 MEDIUM | uri_string does not bound the port component of a URI before integer conversion |
| CVE-2026-71562 | 6.3 MEDIUM | httpc does not bound server-supplied numeric header values before integer conversion |
| CVE-2026-70405 | 6.3 MEDIUM | snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields |
| CVE-2026-74994 | 6.0 MEDIUM | inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
IV. Related Vulnerabilities
Same product: OTP
-
CVE-2026-69664
httpd parks a request worker indefinitely on a malformed chu -
CVE-2026-70405
snmp BER INTEGER decoder applies no size limit to attacker-s -
CVE-2026-66835
httpd mod_auth directory protection bypassed by a doubled sl -
CVE-2026-73270
httpd mod_auth directory protection bypassed by request path -
CVE-2026-75538
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Ove
Same vendor: Erlang
-
CVE-2026-69664
httpd parks a request worker indefinitely on a malformed chu -
CVE-2026-70405
snmp BER INTEGER decoder applies no size limit to attacker-s -
CVE-2026-66835
httpd mod_auth directory protection bypassed by a doubled sl -
CVE-2026-73270
httpd mod_auth directory protection bypassed by request path -
CVE-2026-75538
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Ove
Same weakness: CWE-1284
-
CVE-2026-70405
snmp BER INTEGER decoder applies no size limit to attacker-s -
CVE-2026-59696
uri_string does not bound the port component of a URI before -
CVE-2026-71562
httpc does not bound server-supplied numeric header values b -
CVE-2026-82734
Non-finite Infinity/NaN decimal values bypass bounds constra -
CVE-2026-81779
WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulner
V. Comments for CVE-2026-70409
No comments yet