Erlang Otp vulnerabilities
63 known vulnerabilities affecting erlang/otp.
Total CVEs
63
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL4HIGH27MEDIUM27LOW5
Vulnerabilities
Page 4 of 4
CVE-2026-28810P4LOWCVSS 3.7≥ 3.0, < *≥ 17.0, < *+1 more2026-04-07
CVE-2026-28810 [LOW] CWE-340 CVE-2026-28810: Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.
The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID,
nvd
CVE-2026-21620P4LOWCVSS 2.3≥ 17.0, < *≥ 07b8f441ca711f9812fad9e9115bab3c3aa92f79, < *+2 more2026-02-20
CVE-2026-21620 [LOW] CWE-23 CVE-2026-21620: Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erla
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.
This issue affects OT
nvd
CVE-2025-46712P4LOWCVSS 3.7v>= OTP 27.0, < OTP 27.3.4v>= OTP 26.2.1, < OTP 26.2.5.12+1 more2025-05-08
CVE-2025-46712 [LOW] CWE-440 CVE-2025-46712: Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these me
nvd
← Previous4 / 4