Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Uncontrolled Resource Consumption CWE-400 CWE-400 at MITRE
The product does not properly control the allocation and maintenance of a limited resource.
Allocation of Resources Without Limits or Throttling CWE-770
65
(73.0%)
Asymmetric Resource Consumption (Amplification) CWE-405
24
(27.0%)
Missing Reference to Active Allocated Resource CWE-771
0
(0.0%)
Logging of Excessive Data CWE-779
0
(0.0%)
Improper Restriction of Power Consumption CWE-920
0
(0.0%)
Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations CWE-1235
0
(0.0%)
Improper Write Handling in Limited-write Non-Volatile Memories CWE-1246
0
(0.0%)
Classified as CWE-400 itself, not a child weakness
13
CVEs
CVEs for Uncontrolled Resource Consumption CWE-400
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | CVE-2026-65631 | 2026-10-26 | |
| Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 | CVE-2026-65627 | 2026-10-26 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit | CVE-2026-108529 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit | CVE-2026-109584 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| Quadratic bignum parsing of Content-Length and Host port values in Bandit | CVE-2026-113436 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| Unbounded SAML message decompression in esaml allows memory exhaustion | CVE-2026-93471 | 2026-10-22 | |
| Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | CVE-2026-86696 | 2026-10-22 | |
| Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | CVE-2026-105270 | 2026-10-22 | |
| HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit | CVE-2026-105659 | 2026-10-14 | |
| hex_core decompresses registry and Erlang term API responses without size limits |
rebar3
Hex Mix Integration
|
CVE-2026-105274 | 2026-10-12 |
| Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
Hex Mix Integration
|
CVE-2026-96618 | 2026-10-12 |
| Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS | CVE-2026-97853 | 2026-10-10 | |
| Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash | CVE-2026-94201 | 2026-10-05 | |
| Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size | CVE-2026-92103 | 2026-09-28 | |
| HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory | CVE-2026-91043 | 2026-09-28 | |
| Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder |
Erlang
pkg:otp/asn1
|
CVE-2026-65634 | 2026-09-22 |
| SSH daemon allocates unbounded idle session channels, bypassing max_channels |
Erlang
pkg:otp/ssh
|
CVE-2026-68956 | 2026-09-22 |
25 per page ·
102 CVEs