Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1000
Switch view
CWE-1000 at MITRE
Switch view
We're looking at the CWE hierarchy through the Research Concepts view.
Improper Control of a Resource Through its Lifetime CWE-664
161
(44.1%)
Improper Neutralization CWE-707
69
(18.9%)
Improper Access Control CWE-284
58
(15.9%)
Protection Mechanism Failure CWE-693
24
(6.6%)
Insufficient Control Flow Management CWE-691
14
(3.8%)
Improper Check or Handling of Exceptional Conditions CWE-703
14
(3.8%)
Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435
12
(3.3%)
Improper Adherence to Coding Standards CWE-710
7
(1.9%)
Incorrect Calculation CWE-682
3
(0.8%)
Incorrect Comparison CWE-697
3
(0.8%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries | CVE-2026-94194 | 2026-09-28 | |
| Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size | CVE-2026-92103 | 2026-09-28 | |
| HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory | CVE-2026-91043 | 2026-09-28 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 | |
| Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash | CVE-2026-93477 | 2026-09-25 | |
| Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy | CVE-2026-91187 | 2026-09-24 | |
| Refresh tokens accepted as private repository credentials at the CDN | CVE-2026-86698 | 2026-09-22 | |
| mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed | CVE-2026-87119 | 2026-09-22 | |
| Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free | CVE-2026-89420 | 2026-09-22 | |
| Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder |
Erlang
pkg:otp/asn1
|
CVE-2026-65634 | 2026-09-22 |
| SSH daemon allocates unbounded idle session channels, bypassing max_channels |
Erlang
pkg:otp/ssh
|
CVE-2026-68956 | 2026-09-22 |
| TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension |
Erlang
Erlang / ssl
|
CVE-2026-89422 | 2026-09-22 |
| Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections | CVE-2026-82672 | 2026-09-19 | |
| Session id is not renewed on authentication in ash_authentication, allowing session fixation | CVE-2026-86688 | 2026-09-17 | |
| Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | CVE-2026-76949 | 2026-09-17 | |
| dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | CVE-2026-91039 | 2026-09-17 | |
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | CVE-2026-85500 | 2026-09-17 | |
| Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | CVE-2026-86533 | 2026-09-17 | |
| Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix | CVE-2026-81632 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| Token revocation record built from unverified JWT claims in AshAuthentication | CVE-2026-78223 | 2026-09-17 | |
| Log injection via an unescaped password reset identity in AshAuthentication | CVE-2026-86522 | 2026-09-17 | |
| Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | CVE-2026-81637 | 2026-09-17 | |
| Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | CVE-2026-82761 | 2026-09-17 |
25 per page ·
317 CVEs