Vendor
Erlang
84 known vulnerabilities in products by Erlang, 1 of them actively exploited (CISA KEV).
Key figures
84
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-32433 | Erlang/OTP SSH Vulnerable to Pre-Authentication RCE In CISA KEValso in 16 other products | 10.0 | |
| Critical | CVE-2020-13802 | Erlang Rebar3: OS Command Injection | 9.8 | |
| Medium | CVE-2023-48795 | SSH Communications Security SSH daemon: security vulnerability | 5.9 | |
| Medium | CVE-2017-1000385 | Erlang OTP: security vulnerability | 5.9 | |
| High | CVE-2020-25623 | Erlang OTP: Path Traversal | 7.5 | |
| High | CVE-2026-69664 | httpd parks a request worker indefinitely on a malformed chunk size sent after the headers | — | |
| High | CVE-2026-70399 | httpd does not enforce the documented default max_clients connection limit | — | |
| High | CVE-2026-66835 | httpd mod_auth directory protection bypassed by a doubled slash in the request path | — | |
| High | CVE-2026-73270 | httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems | — | |
| Critical | CVE-2022-37026 | Erlang OTP: Authentication Bypass | 9.8 | |
| High | CVE-2026-75538 | Erlang OTP: Heap-based Buffer Overflow | — | |
| High | CVE-2019-1000014 | Erlang Rebar3: Code Execution | 8.8 | |
| Critical | CVE-2016-10253 | Erlang OTP: security vulnerability | 9.8 | |
| High | CVE-2026-71380 | httpd applies no timeout while receiving a request body, parking a worker on a stalled client | — | |
| High | CVE-2026-55951 | httpc memory exhaustion via unbounded response header accumulation | — | |
| High | CVE-2026-59250 | Megaco flex scanner buffer overflow via oversized property parm name | — | |
| Critical | CVE-2026-89422 | Erlang OTP: Key Exchange without Entity Authentication | — | |
| High | CVE-2026-74835 | inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception | — | |
| High | CVE-2026-73276 | inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i | — | |
| High | CVE-2026-66357 | inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation | — | |
| High | CVE-2026-94200 | TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl | — | |
| Medium | CVE-2026-59696 | uri_string does not bound the port component of a URI before integer conversion | — | |
| High | CVE-2026-73812 | inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length | — | |
| Critical | CVE-2026-28808 | ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) | 9.8 | |
| Medium | CVE-2015-2774 | Erlang OTP: security vulnerability | 5.9 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,
Products
| Erlang OTP | 64 | 1 |
| Erlang\/otp | 41 | 1 |
| Erlang\/ssl | 8 | 0 |
| Erlang\/ssh | 7 | 0 |
| Erlang Rebar3 | 6 | 0 |
| Erlang\/inets | 4 | 0 |
| Erlang Runtime System (ERTS) | 4 | 0 |
| Mpp | 3 | 0 |