Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74994— inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0至27.3.4.17之前版本、28.0至28.5.0.6之前版本和29.0至29.0.6之前版本存在安全漏洞，该漏洞源于OTP的inets httpd服务器中的mod_auth模块在配置dets或mnesia认证后端和多个目录配置块时，将所有目录块折叠为单一共享用户/组命名空间，可能导致添加到某个受保护目录的用户被接受为其他受保

CVSS 6.0 · Medium EPSS 0.63% · P50

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 9

VendorProduct Version RangeStatus
Erlang OTP < 17.0 unknown
17.0< 27.3.4.17 affected
28.0< 28.5.0.6 affected
29.0< 29.0.6 affected
< 5.10 unknown
5.10< 9.3.2.7 affected
9.4< 9.6.2.3 affected
9.7< 9.7.2 affected
… +1 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74994

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
Source: CVE Program / CVE List V5
Vulnerability Description
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0至27.3.4.17之前版本、28.0至28.5.0.6之前版本和29.0至29.0.6之前版本存在安全漏洞，该漏洞源于OTP的inets httpd服务器中的mod_auth模块在配置dets或mnesia认证后端和多个目录配置块时，将所有目录块折叠为单一共享用户/组命名空间，可能导致添加到某个受保护目录的用户被接受为其他受保
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 17.0 ~ 27.3.4.17 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 5.10 ~ 9.3.2.7 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 84adefa331c4159d432d22840663c38f155cd4c1 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-74994

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74994

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74994 (3)

Vendor Advisories for CVE-2026-74994 (3)

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380 8.7 HIGH httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399 8.7 HIGH httpd does not enforce the documented default max_clients connection limit
CVE-2026-74835 8.7 HIGH inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-69664 8.7 HIGH httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-66357 8.3 HIGH inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812 8.3 HIGH inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276 8.3 HIGH inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951 8.2 HIGH httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538 8.2 HIGH A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835 8.2 HIGH httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270 8.2 HIGH httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696 6.9 MEDIUM uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562 6.3 MEDIUM httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405 6.3 MEDIUM snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409 6.3 MEDIUM eldap does not bound the port component of a referral URL before integer conversion

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-863