Product by Erlang
Erlang\/otp
41 known vulnerabilities in Erlang\/otp (Erlang), 1 of them actively exploited (CISA KEV).
Key figures
41
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-32433 | Erlang/OTP SSH Vulnerable to Pre-Authentication RCE In CISA KEValso in 17 other products | 10.0 | |
| Medium | CVE-2023-48795 | SSH Communications Security SSH daemon: security vulnerability | 5.9 | |
| Medium | CVE-2017-1000385 | Erlang OTP: security vulnerability | 5.9 | |
| High | CVE-2020-25623 | Erlang OTP: Path Traversal | 7.5 | |
| Critical | CVE-2022-37026 | Erlang OTP: Authentication Bypass | 9.8 | |
| Critical | CVE-2016-10253 | Erlang OTP: security vulnerability | 9.8 | |
| Critical | CVE-2026-28808 | ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) | 9.8 | |
| Medium | CVE-2015-2774 | Erlang OTP: security vulnerability | 5.9 | |
| High | CVE-2026-49759 | Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash | 8.2 | |
| Critical | CVE-2026-23941 | Request smuggling via first-wins Content-Length parsing in inets httpd | 9.4 | |
| High | CVE-2026-55952 | TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension | 7.5 | |
| Medium | CVE-2016-1000107 | Erlang OTP: security vulnerability | 6.1 | |
| High | CVE-2026-58227 | TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain | 7.5 | |
| High | CVE-2020-35733 | Erlang OTP: security vulnerability | 7.5 | |
| High | CVE-2026-54890 | BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding | 7.5 | |
| High | CVE-2026-55950 | Erlang OTP: Time-of-check Time-of-use (TOCTOU) Race Condition | 5.9 | |
| Medium | CVE-2026-23943 | Pre-auth SSH DoS via unbounded zlib inflate | 5.3 | |
| High | CVE-2026-42792 | epmd permanent DoS via EMFILE on accept(2) in erts | 7.5 | |
| High | CVE-2026-59251 | Denial of service via exponential certificate policy tree growth in path validation | 7.5 | |
| Critical | CVE-2026-55953 | TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication | 7.4 | |
| High | CVE-2026-42790 | nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification | 8.1 | |
| High | CVE-2026-55737 | Erlang OTP: Signed to Unsigned Conversion Error | 7.5 | |
| Not rated | CVE-2011-0766 | Erlang Crypto application: security vulnerability | — | |
| High | CVE-2026-42789 | Non-CA certificate accepted as intermediate issuer in public_key path validation | 4.8 | |
| High | CVE-2026-48856 | httpc leaks Authorization header to cross-origin redirect targets | 6.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,