Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Control of a Resource Through its Lifetime CWE-664 CWE-664 at MITRE
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Uncontrolled Resource Consumption CWE-400
77
(37.0%)
Improper Initialization CWE-665
50
(24.0%)
Exposure of Resource to Wrong Sphere CWE-668
18
(8.7%)
Use of Incorrectly-Resolved Name or Reference CWE-706
18
(8.7%)
Externally Controlled Reference to a Resource in Another Sphere CWE-610
13
(6.3%)
Improper Control of Dynamically-Managed Code Resources CWE-913
9
(4.3%)
Operation on Resource in Wrong Phase of Lifetime CWE-666
6
(2.9%)
Incorrect Access of Indexable Resource ('Range Error') CWE-118
5
(2.4%)
Improper Synchronization CWE-662
4
(1.9%)
Improper Resource Shutdown or Release CWE-404
3
(1.4%)
Incorrect Resource Transfer Between Spheres CWE-669
2
(1.0%)
Insecure Storage of Sensitive Information CWE-922
2
(1.0%)
Incorrect Type Conversion or Cast CWE-704
1
(0.5%)
Information Loss or Omission CWE-221
0
(0.0%)
Incomplete Internal State Distinction CWE-372
0
(0.0%)
Insufficient Resource Pool CWE-410
0
(0.0%)
Modification of Assumed-Immutable Data (MAID) CWE-471
0
(0.0%)
Reliance on Package-level Scope CWE-487
0
(0.0%)
Private Data Structure Returned From A Public Method CWE-495
0
(0.0%)
Public Data Assigned to Private Array-Typed Field CWE-496
0
(0.0%)
Trust Boundary Violation CWE-501
0
(0.0%)
clone() Method Without super.clone() CWE-580
0
(0.0%)
External Influence of Sphere Definition CWE-673
0
(0.0%)
Improper Update of Reference Count CWE-911
0
(0.0%)
Creation of Emergent Resource CWE-1229
0
(0.0%)
Improper Preservation of Consistency Between Independent Representations of Shared State CWE-1250
0
(0.0%)
Reliance on Component That is Not Updateable CWE-1329
0
(0.0%)
CVEs
CVEs for Improper Control of a Resource Through its Lifetime CWE-664
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Session id is not renewed on authentication in ash_authentication, allowing session fixation | CVE-2026-86688 | 2026-09-17 | |
| Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | CVE-2026-86533 | 2026-09-17 | |
| Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix | CVE-2026-81632 | 2026-09-17 | |
| Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | CVE-2026-81637 | 2026-09-17 | |
| Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | CVE-2026-82761 | 2026-09-17 | |
| Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in | CVE-2026-82760 | 2026-09-17 | |
| Actor record with password digest stored in AshAuthentication audit log entries | CVE-2026-82723 | 2026-09-17 | |
| mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches | CVE-2026-89186 | 2026-09-16 | |
| SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts | CVE-2026-77866 | 2026-09-15 | |
| safeurl validated address is not bound to the request, allowing DNS rebinding | CVE-2026-77972 | 2026-09-15 | |
| ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF | CVE-2026-82757 | 2026-09-07 | |
| ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion | CVE-2026-82755 | 2026-09-07 | |
| Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server | CVE-2026-82753 | 2026-09-07 | |
| Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS | CVE-2026-82728 | 2026-09-04 | |
| Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS | CVE-2026-82729 | 2026-09-04 | |
| httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
Erlang
pkg:otp/inets
|
CVE-2026-69664 | 2026-09-01 |
| httpd mod_auth directory protection bypassed by a doubled slash in the request path |
Erlang
pkg:otp/inets
|
CVE-2026-66835 | 2026-09-01 |
| httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems |
Erlang
pkg:otp/inets
|
CVE-2026-73270 | 2026-09-01 |
| A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer |
Erlang
pkg:otp/erts
|
CVE-2026-75538 | 2026-09-01 |
| inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception |
Erlang
pkg:otp/inets
|
CVE-2026-74835 | 2026-09-01 |
| httpc memory exhaustion via unbounded response header accumulation |
Erlang
pkg:otp/inets
|
CVE-2026-55951 | 2026-09-01 |
| httpd applies no timeout while receiving a request body, parking a worker on a stalled client |
Erlang
pkg:otp/inets
|
CVE-2026-71380 | 2026-09-01 |
| httpd does not enforce the documented default max_clients connection limit |
Erlang
pkg:otp/inets
|
CVE-2026-70399 | 2026-09-01 |
| Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads | CVE-2026-82743 | 2026-09-01 | |
| Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory | CVE-2026-82742 | 2026-09-01 |
25 per page ·
155 CVEs