Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

otp — Vulnerabilities & Security Advisories 61

All 61 CVE vulnerabilities found in otp, with AI-generated Chinese analysis, references, and POCs.

This aggregation page compiles security vulnerabilities affecting the "otp" product, organized by vendor, product, weakness type, and classification tags. It collects a range of flaws, including buffer overflows, logic errors, and memory corruption, covering the full historical record from initial release through the most recent patch releases. Readers can use this page to track a vendor's advisory history, understand a specific weakness class in the context of OTP implementations, or look up the complete vulnerability history for the product. The data is presented without promotional language, focusing on factual reporting of identified issues, their severity ratings, and remediation guidance. This resource supports security professionals seeking to assess exposure, prioritize patching, and analyze trends in vulnerability disclosure patterns over time.

Vendor: erlang

CVE ID Title CVSS Severity Published
CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder CWE-407 8.2 High 2026-09-22
CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels CWE-770 7.1 High 2026-09-22
CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension CWE-322 9.3 Critical 2026-09-22
CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers CWE-772 8.7 High 2026-09-01
CVE-2026-70409 eldap does not bound the port component of a referral URL before integer conversion CWE-1284 6.3 Medium 2026-09-01
CVE-2026-70405 snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields CWE-1284 6.3 Medium 2026-09-01
CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path CWE-50 8.2 High 2026-09-01
CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems CWE-178 8.2 High 2026-09-01
CVE-2026-75538 A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer CWE-190 8.2 High 2026-09-01
CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth CWE-863 6.0 Medium 2026-09-01
CVE-2026-74835 inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception CWE-770 8.7 High 2026-09-01
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length CWE-444 8.3 High 2026-09-01
CVE-2026-73276 inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i CWE-444 8.3 High 2026-09-01
CVE-2026-66357 inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation CWE-444 8.3 High 2026-09-01
CVE-2026-59696 uri_string does not bound the port component of a URI before integer conversion CWE-1284 6.9 Medium 2026-09-01
CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation CWE-770 8.2 High 2026-09-01
CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client CWE-772 8.7 High 2026-09-01
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion CWE-1284 6.3 Medium 2026-09-01
CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit CWE-770 8.7 High 2026-09-01
CVE-2026-54890 BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding CWE-191 8.2 High 2026-07-27
CVE-2026-59251 Denial of service via exponential certificate policy tree growth in path validation CWE-770 8.7 High 2026-07-27
CVE-2026-59250 Megaco flex scanner buffer overflow via oversized property parm name CWE-120 8.3 High 2026-07-27
CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication CWE-757 9.1 Critical 2026-07-27
CVE-2026-55737 Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder CWE-195 5.1 Medium 2026-07-27
CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass CWE-23 4.8 Medium 2026-07-27
CVE-2026-42792 epmd permanent DoS via EMFILE on accept(2) in erts CWE-755 6.3 Medium 2026-07-27
CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain CWE-674 8.7 High 2026-07-27
CVE-2026-54891 Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl CWE-924 6.3 Medium 2026-07-02
CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions CWE-367 8.7 High 2026-07-02
CVE-2026-54886 SSH SFTP server denial of service via extended channel data infinite loop CWE-835 5.3 Medium 2026-07-02

All 61 known CVE vulnerabilities affecting otp with full Chinese analysis, references, and POCs where available.