Erlang Ecosystem Foundation CNA | This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).

The Erlang Ecosystem Foundation CNA is a collaborative effort to assign and maintain CVE identifiers within the ecosystem, providing a consistent and transparent process for reporting, documenting, and mitigating security vulnerabilities.

As a CNA (CVE Numbering Authority), we assign CVE IDs for vulnerabilities in active packages hosted on Hex.pm and in projects under the GitHub organizations listed in our scope. All CVEs are also published to OSV.dev. This CNA is hosted by the Erlang Ecosystem Foundation’s Security Working Group.

CVE Activity

CVEs published by quarter since the CNA was established.

Latest CVEs

CVE-2026-47074 May 28, 2026

ex_aws_sns SigningCertURL not validated in verify_message/1

pkg:hex/ex_aws_sns

CVE-2026-42790 May 27, 2026

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

pkg:otp/public_key

CVE-2026-42791 May 27, 2026

OCSP responder certificate validity period not checked in public_key

pkg:otp/public_key

Resources

CNA Scope What projects we cover Contact Report a vulnerability CVE Criteria Assignment guidelines Security Policy Disclosure process Data Licensing License information Common Weaknesses CWE distribution Maintainer Process How coordinated disclosure works Coordinator Process Volunteer to handle reports