{"kind": "product", "path": "vulns/ubuntu-25.10/erlang", "name": "erlang", "product": "erlang", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-54891", "noindex": false, "published": "2026-07-02T16:06:30.982Z", "modified": "2026-09-08T01:06:03.832Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00135, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-54891", "title": "Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data.\n\nThe function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The re", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-gf6r-99xw-6qg6", "https://cna.erlef.org/cves/CVE-2026-54891.html", "https://osv.dev/vulnerability/EEF-CVE-2026-54891"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55950", "noindex": false, "published": "2026-07-02T16:06:24.783Z", "modified": "2026-07-24T14:14:42.082Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00379, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55950", "title": "DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions", "description": "Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener.\n\nA DTLS server listener uses a single shared dtls_packet_demux gen_server process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple ClientHello messages in quick succession), a race condition in the demux's internal gb_trees key-value store causes a {key_exists, {old, Client}} crash, terminating the demux process. Because the demux is sh", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3", "https://cna.erlef.org/cves/CVE-2026-55950.html", "https://osv.dev/vulnerability/EEF-CVE-2026-55950"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-54886", "noindex": false, "published": "2026-07-02T16:06:20.502Z", "modified": "2026-07-24T14:14:32.812Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-54886", "title": "SSH SFTP server denial of service via extended channel data infinite loop", "description": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive.\n\nThe handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with identical arguments, creating an infinite loop.\n\nThe SFTP protocol operates exclusively on normal channel data (type 0). Extended data (non-zero type", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9", "https://cna.erlef.org/cves/CVE-2026-54886.html", "https://osv.dev/vulnerability/EEF-CVE-2026-54886"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55952", "noindex": false, "published": "2026-07-02T16:06:08.474Z", "modified": "2026-07-24T14:14:09.990Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00481, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55952", "title": "TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension", "description": "The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:use/4, which crashes the session ticket handler process.\n\nAn unauthenticated remote attacker can send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket hand", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-8c57-44c9-pc59", "https://cna.erlef.org/cves/CVE-2026-55952.html", "https://osv.dev/vulnerability/EEF-CVE-2026-55952"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-54887", "noindex": false, "published": "2026-07-02T16:06:04.156Z", "modified": "2026-07-24T14:15:16.337Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00243, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-54887", "title": "DTLS server cookie bypass during startup window due to empty initial cookie secret", "description": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\n\nOn DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that ", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8", "https://cna.erlef.org/cves/CVE-2026-54887.html", "https://osv.dev/vulnerability/EEF-CVE-2026-54887"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-53422", "noindex": false, "published": "2026-07-02T16:06:03.802Z", "modified": "2026-07-24T14:16:07.357Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53422", "title": "SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root", "description": "Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.\n\nThe SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.\n\nAn authenticate", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976", "https://cna.erlef.org/cves/CVE-2026-53422.html", "https://osv.dev/vulnerability/EEF-CVE-2026-53422"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48856", "noindex": false, "published": "2026-06-10T14:41:51.616Z", "modified": "2026-10-15T10:50:06.903Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48856", "title": "httpc leaks Authorization header to cross-origin redirect targets", "description": "Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data.\n\nThe httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host.\n\nautoredirect defaults to true, so this affects all httpc callers that do not explic", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh", "https://cna.erlef.org/cves/CVE-2026-48856.html", "https://osv.dev/vulnerability/EEF-CVE-2026-48856"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48860", "noindex": false, "published": "2026-06-10T14:35:49.987Z", "modified": "2026-09-24T20:39:54.903Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0021, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48860", "title": "Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist", "description": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv", "https://cna.erlef.org/cves/CVE-2026-48860.html", "https://osv.dev/vulnerability/EEF-CVE-2026-48860"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48855", "noindex": false, "published": "2026-06-10T14:35:49.683Z", "modified": "2026-09-24T20:35:33.970Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00299, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48855", "title": "SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured", "description": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.\n\nThe SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.\n\nThe information disclosed is the absolute filesystem p", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh", "https://cna.erlef.org/cves/CVE-2026-48855.html", "https://osv.dev/vulnerability/EEF-CVE-2026-48855"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48858", "noindex": false, "published": "2026-06-10T14:35:45.466Z", "modified": "2026-07-24T14:16:02.204Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00234, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48858", "title": "ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks", "description": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connecti", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq", "https://cna.erlef.org/cves/CVE-2026-48858.html", "https://osv.dev/vulnerability/EEF-CVE-2026-48858"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48859", "noindex": false, "published": "2026-06-10T14:35:43.553Z", "modified": "2026-09-08T01:05:48.773Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48859", "title": "SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration", "description": "Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.\n\nWhen the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.\n", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4", "https://cna.erlef.org/cves/CVE-2026-48859.html", "https://osv.dev/vulnerability/EEF-CVE-2026-48859"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-49759", "noindex": false, "published": "2026-06-10T14:35:38.838Z", "modified": "2026-09-24T20:41:04.351Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00497, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-49759", "title": "Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash", "description": "Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.\n\nThe sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fi", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97", "https://cna.erlef.org/cves/CVE-2026-49759.html", "https://osv.dev/vulnerability/EEF-CVE-2026-49759"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-49760", "noindex": false, "published": "2026-06-10T14:35:36.804Z", "modified": "2026-09-24T20:42:47.418Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-49760", "title": "Stack Buffer Overflow in ei_s_print_term at Very Large Integer", "description": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints d", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j", "https://cna.erlef.org/cves/CVE-2026-49760.html", "https://osv.dev/vulnerability/EEF-CVE-2026-49760"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42790", "noindex": false, "published": "2026-05-27T15:09:01.860Z", "modified": "2026-09-18T12:04:51.323Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42790", "title": "nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification", "description": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):\n\nFirst, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts c", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447", "https://cna.erlef.org/cves/CVE-2026-42790.html", "https://osv.dev/vulnerability/EEF-CVE-2026-42790"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42791", "noindex": false, "published": "2026-05-27T12:23:13.584Z", "modified": "2026-07-24T14:14:24.911Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00316, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42791", "title": "OCSP responder certificate validity period not checked in public_key", "description": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.\n\nOCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.\n\nThis affects TLS clients using OCSP stapling via the ssl applicatio", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff", "https://cna.erlef.org/cves/CVE-2026-42791.html", "https://osv.dev/vulnerability/EEF-CVE-2026-42791"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42789", "noindex": false, "published": "2026-05-27T12:23:06.355Z", "modified": "2026-10-14T16:55:37.359Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00383, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42789", "title": "Non-CA certificate accepted as intermediate issuer in public_key path validation", "description": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fi", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq", "https://cna.erlef.org/cves/CVE-2026-42789.html", "https://osv.dev/vulnerability/EEF-CVE-2026-42789"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-32147", "noindex": false, "published": "2026-04-21T12:01:20.350Z", "modified": "2026-07-24T14:14:17.633Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "severity": "medium", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32147", "title": "SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.\n\nThe SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.\n\nAny authenticated SFTP user on a server configured with the root option can modify file attributes of files ", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-28jg-mw9x-hpm5", "https://cna.erlef.org/cves/CVE-2026-32147.html", "https://osv.dev/vulnerability/EEF-CVE-2026-32147"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28808", "noindex": false, "published": "2026-04-07T12:28:16.056Z", "modified": "2026-09-22T09:08:02.163Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00556, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28808", "title": "ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)", "description": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.\n\nWhen script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and ", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f", "https://cna.erlef.org/cves/CVE-2026-28808.html", "https://osv.dev/vulnerability/EEF-CVE-2026-28808"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-32144", "noindex": false, "published": "2026-04-07T12:28:00.767Z", "modified": "2026-07-24T14:14:52.819Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "severity": "high", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32144", "title": "OCSP designated-responder authorization bypass via missing signature verification", "description": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCS", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm", "https://cna.erlef.org/cves/CVE-2026-32144.html", "https://osv.dev/vulnerability/EEF-CVE-2026-32144"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28810", "noindex": false, "published": "2026-04-07T07:50:11.072Z", "modified": "2026-07-24T14:16:14.097Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28810", "title": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver", "description": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier docu", "references": ["https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8", "https://cna.erlef.org/cves/CVE-2026-28810.html", "https://osv.dev/vulnerability/EEF-CVE-2026-28810"], "fixes": [], "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}]}], "total": 31, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "erlang", "path": "vulns/ubuntu-25.10/erlang", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-15T10:50:06.903Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}