CVE-2026-59696
published 2026-09-01CVE-2026-59696: Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose…
PriorityP346medium6.9CVSS 4.0
AVNACLATNPRNUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.71%
53.0th percentile
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits.
uri_string:get_port/1 passes the port substring to binary_to_integer/1 with no length bound, catching only error:badarg, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the calling process hundreds of milliseconds of arbitrary-precision arithmetic. The conversion is reached from every authority-parsing path in uri_string:parse/1, including the host, registered-name, and IPv4 and IPv6 forms. parse/1 is the documented interface for parsing URIs, so any application that parses an attacker-supplied URI is exposed without further configuration. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.
This issue affects OTP from OTP 21.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to stdlib from 3.5 before 6.2.2.5, from 7.0 before 7.3.0.2, and from 8.0 before 8.0.4.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| erlang | otp | >= 21.0 < 27.3.4.17 | 27.3.4.17 |
| erlang | otp | >= 28.0 < 28.5.0.6 | 28.5.0.6 |
| erlang | otp | >= 29.0 < 29.0.6 | 29.0.6 |
| erlang | otp | >= 29a9dd0e17a97a3e6e46f0d08c6ba8f31db33f5e < * | * |
| erlang | otp | >= 3.5 < 6.2.2.5 | 6.2.2.5 |
| erlang | otp | >= 7.0 < 7.3.0.2 | 7.3.0.2 |
| erlang | otp | >= 8.0 < 8.0.4 | 8.0.4 |
| ubuntu | erlang | — | — |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Erlang vulnerabilities
vendor_ubuntu·2026-09-28·CVSS 7.5
CVE-2026-23941 [HIGH] Erlang vulnerabilities
Title: Erlang vulnerabilities
Summary: Several security issues were fixed in Erlang.
It was discovered that the Erlang Port Mapper Daemon did not properly
handle slow connections. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-42792)
It was discovered that Erlang incorrectly handled certain external term
format data, leading to heap corruption. An attacker could possibly use
this issue to cause Erlang to crash, resulting in a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-55737)
It was discovered that Erlang incorrectly handled invalid external term
format data. An attacker could possibly use this issue to cause Erlang to
crash, resulting in a denial of service. This issue only affected Ubuntu
26.04
VulDB
Erlang OTP 27.3.4.16/28.4.x/29.0.5 stdlib uri_string.erl uri_string.get_port input validation (WID-SEC-2026-3146)
vuldb·2026-09-03·CVSS 6.9
CVE-2026-59696 [MEDIUM] Erlang OTP 27.3.4.16/28.4.x/29.0.5 stdlib uri_string.erl uri_string.get_port input validation (WID-SEC-2026-3146)
A vulnerability classified as problematic was found in Erlang OTP 27.3.4.16/28.4.x/29.0.5. Affected by this issue is the function uri_string.get_port of the file uri_string.erl of the component stdlib. Executing a manipulation of the argument port can lead to improper input validation.
The identification of this vulnerability is CVE-2026-59696. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-59696.htmlhttps://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042dhttps://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aahttps://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2https://osv.dev/vulnerability/EEF-CVE-2026-59696https://www.erlang.org/doc/system/versions.html#order-of-versions
2026-09-01
Published