Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

otp — Vulnerabilities & Security Advisories 61

All 61 CVE vulnerabilities found in otp, with AI-generated Chinese analysis, references, and POCs.

This aggregation page compiles security vulnerabilities affecting the "otp" product, organized by vendor, product, weakness type, and classification tags. It collects a range of flaws, including buffer overflows, logic errors, and memory corruption, covering the full historical record from initial release through the most recent patch releases. Readers can use this page to track a vendor's advisory history, understand a specific weakness class in the context of OTP implementations, or look up the complete vulnerability history for the product. The data is presented without promotional language, focusing on factual reporting of identified issues, their severity ratings, and remediation guidance. This resource supports security professionals seeking to assess exposure, prioritize patching, and analyze trends in vulnerability disclosure patterns over time.

Vendor: erlang

CVE ID Title CVSS Severity Published
CVE-2026-55952 TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension CWE-1284 8.2 High 2026-07-02
CVE-2026-54887 DTLS server cookie bypass during startup window due to empty initial cookie secret CWE-1394 6.3 Medium 2026-07-02
CVE-2026-53422 SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root CWE-204 2.3 Low 2026-07-02
CVE-2026-48856 httpc leaks Authorization header to cross-origin redirect targets CWE-601 7.1 High 2026-06-10
CVE-2026-48855 SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured CWE-200 2.3 Low 2026-06-10
CVE-2026-48860 Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist CWE-1025 7.5 High 2026-06-10
CVE-2026-48858 ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks CWE-918 6.3 Medium 2026-06-10
CVE-2026-48859 SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration CWE-208 6.3 Medium 2026-06-10
CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CWE-121 8.8 High 2026-06-10
CVE-2026-49760 Stack Buffer Overflow in ei_s_print_term at Very Large Integer CWE-121 6.9 Medium 2026-06-10
CVE-2026-42790 nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification CWE-295 7.6 High 2026-05-27
CVE-2026-42791 OCSP responder certificate validity period not checked in public_key CWE-295 6.3 Medium 2026-05-27
CVE-2026-42789 Non-CA certificate accepted as intermediate issuer in public_key path validation CWE-295 7.0 High 2026-05-27
CVE-2026-32147 SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT CWE-22 5.3 Medium 2026-04-21
CVE-2026-28808 ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) CWE-863 8.3 High 2026-04-07
CVE-2026-32144 OCSP designated-responder authorization bypass via missing signature verification CWE-295 7.6 High 2026-04-07
CVE-2026-28810 Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver CWE-340 6.3 Medium 2026-04-07
CVE-2026-23941 Request smuggling via first-wins Content-Length parsing in inets httpd CWE-444 7.0 High 2026-03-13
CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate CWE-409 6.9 Medium 2026-03-13
CVE-2026-23942 SFTP root escape via component-agnostic prefix check in ssh_sftpd CWE-22 5.3 Medium 2026-03-13
CVE-2026-21620 TFTP Path Traversal CWE-23 2.3 Low 2026-02-20
CVE-2025-48041 SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles CWE-770 7.1 High 2025-09-11
CVE-2025-48040 Malicious Key Exchange Messages may Lead to Excessive Resource Consumption CWE-400 6.9 Medium 2025-09-11
CVE-2025-48039 Unverified Paths can Cause Excessive Use of System Resources CWE-770 5.3 Medium 2025-09-11
CVE-2025-48038 Unverified File Handles can Cause Excessive Use of System Resources CWE-770 5.3 Medium 2025-09-11
CVE-2025-4748 Absolute path traversal in zip:unzip/1,2 CWE-22 4.8 Medium 2025-06-16
CVE-2025-46712 Erlang/OTP SSH Has Strict KEX Violations CWE-440 3.7 Low 2025-05-08
CVE-2025-32433 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE CWE-306 10.0 Critical 2025-04-16
CVE-2025-30211 KEX init error results with excessive memory usage CWE-789 7.5 High 2025-03-28
CVE-2025-26618 SSH SFTP packet size not verified properly in Erlang OTP CWE-789 5.9 - 2025-02-20

All 61 known CVE vulnerabilities affecting otp with full Chinese analysis, references, and POCs where available.