Skip to content
Noroxi

Erlang records

46 published records for vendor Erlang. 1 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
1 · 2.2%
Weaponized
2 · 4.3%
Pre-auth RCE
2
With a fix record
93.5%
Median publish → KEV
54 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

46 records
  • CVE-2025-32433
    100Now

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    erlang · erlang\/otpApr 16, 2025

  • CVE-2017-1000385
    60This week

    The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding.

    MediumCVSS 5.9WeaponizedEPSS 22%

    erlang · erlang\/otpDec 12, 2017

  • CVE-2023-48795
    51Plan

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas

    MediumCVSS 5.9Proof of conceptEPSS 93%

    ssh · sshDec 18, 2023

  • CVE-2020-13802
    41Plan

    Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.

    CriticalCVSS 9.8No exploitEPSS 6%

    erlang · rebar3Sep 2, 2020

  • CVE-2022-37026
    39Monitor

    In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-cert

    CriticalCVSS 9.8No exploitEPSS 1%

    erlang · erlang\/otpSep 21, 2022

  • CVE-2016-10253
    39Monitor

    An issue was discovered in Erlang/OTP 18.x.

    CriticalCVSS 9.8No exploitEPSS 1%

    erlang · erlang\/otpMar 18, 2017

  • CVE-2019-1000014
    36Monitor

    Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Pa

    HighCVSS 8.8No exploitEPSS 1%

    erlang · rebar3Feb 4, 2019

  • CVE-2026-55953
    36Monitor

    TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

    CriticalCVSS 9.1No exploitEPSS 0%

    erlang · erlang/otpJul 27, 2026

  • CVE-2026-49759
    35Monitor

    Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash

    HighCVSS 8.8No exploitEPSS 0%

    erlang · erlang/otpJun 10, 2026

  • CVE-2026-58227
    34Monitor

    TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

    HighCVSS 8.7No exploitEPSS 0%

    erlang · erlang/otpJul 27, 2026

  • CVE-2026-55950
    34Monitor

    DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

    HighCVSS 8.7No exploitEPSS 0%

    erlang · erlang/otpJul 2, 2026

  • CVE-2026-59251
    34Monitor

    Denial of service via exponential certificate policy tree growth in path validation

    HighCVSS 8.7No exploitEPSS 0%

    erlang · erlang/otpJul 27, 2026

  • CVE-2026-28808
    33Monitor

    ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

    HighCVSS 8.3No exploitEPSS 0%

    erlang · erlang/inetsApr 7, 2026

  • CVE-2011-0766
    32Monitor

    The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14

    HighCVSS 7.8No exploitEPSS 3%

    erlang · cryptoMay 31, 2011

  • CVE-2026-55952
    32Monitor

    TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

    HighCVSS 8.2No exploitEPSS 0%

    erlang · erlang/otpJul 2, 2026

  • CVE-2026-54890
    32Monitor

    BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

    HighCVSS 8.2No exploitEPSS 0%

    erlang · erlang/otpJul 27, 2026

  • CVE-2020-25623
    31Monitor

    Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal.

    HighCVSS 7.5No exploitEPSS 3%

    erlang · erlang\/otpOct 2, 2020

  • CVE-2014-1693
    31Monitor

    Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP com

    HighCVSS 7.5No exploitEPSS 2%

    erlang · erlang\/otpDec 8, 2014

  • CVE-2009-0130
    30Monitor

    lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow

    HighCVSS 7.5No exploitEPSS 1%

    erlang · erlangJan 15, 2009

  • CVE-2020-35733
    30Monitor

    An issue was discovered in Erlang/OTP before 23.2.2.

    HighCVSS 7.5No exploitEPSS 1%

    erlang · erlang\/otpJan 15, 2021

  • CVE-2026-42790
    30Monitor

    nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

    HighCVSS 7.6No exploitEPSS 0%

    erlang · erlang/otpMay 27, 2026

  • CVE-2026-32144
    30Monitor

    OCSP designated-responder authorization bypass via missing signature verification

    HighCVSS 7.6No exploitEPSS 0%

    erlang · erlang/otpApr 7, 2026

  • CVE-2026-48860
    30Monitor

    Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

    HighCVSS 7.5No exploitEPSS 0%

    erlang · erlang/otpJun 10, 2026

  • CVE-2021-29221
    28Monitor

    A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3.

    HighCVSS 7.0No exploitEPSS 0%

    erlang · erlang\/otpApr 9, 2021

  • CVE-2026-23941
    28Monitor

    Request smuggling via first-wins Content-Length parsing in inets httpd

    HighCVSS 7.0No exploitEPSS 0%

    erlang · erlang/inetsMar 13, 2026