Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1000
Switch view
CWE-1000 at MITRE
Switch view
We're looking at the CWE hierarchy through the Complete Weakness Hierarchy view.
Improper Control of a Resource Through its Lifetime CWE-664
188
(43.1%)
Improper Neutralization CWE-707
77
(17.7%)
Improper Access Control CWE-284
71
(16.3%)
Protection Mechanism Failure CWE-693
33
(7.6%)
Improper Check or Handling of Exceptional Conditions CWE-703
20
(4.6%)
Insufficient Control Flow Management CWE-691
18
(4.1%)
Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435
15
(3.4%)
Improper Adherence to Coding Standards CWE-710
8
(1.8%)
Incorrect Calculation CWE-682
3
(0.7%)
Incorrect Comparison CWE-697
3
(0.7%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not | CVE-2026-117680 | 2026-11-01 | |
| Unverified Sign in with Apple callback parameter can override verified ID token claims | CVE-2026-117656 | 2026-10-30 | |
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary | CVE-2026-117666 | 2026-10-30 | |
| Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-115274 | 2026-10-30 |
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| Host filesystem path disclosure via DNS rebinding | CVE-2026-109823 | 2026-10-27 | |
| Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose | CVE-2026-65630 | 2026-10-26 | |
| ECDSA signature length is not validated in jose, allowing signature malleability | CVE-2026-65632 | 2026-10-26 | |
| erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | CVE-2026-65631 | 2026-10-26 | |
| Weak PBKDF2 parameters for password-encrypted private-key export in jose | CVE-2026-65629 | 2026-10-26 | |
| Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | CVE-2026-65628 | 2026-10-26 | |
| Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 | CVE-2026-65627 | 2026-10-26 | |
| Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose | CVE-2026-65626 | 2026-10-26 | |
| Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose | CVE-2026-65625 | 2026-10-26 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CVE-2026-115693 | 2026-10-26 | |
| HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | CVE-2026-113440 | 2026-10-26 | |
| SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | CVE-2026-115700 | 2026-10-26 | |
| CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | CVE-2026-112880 | 2026-10-26 | |
| SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit | CVE-2026-108529 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit | CVE-2026-109584 | 2026-10-26 | |
| HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit | CVE-2026-111103 | 2026-10-26 |
25 per page ·
376 CVEs