Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Control of a Resource Through its Lifetime CWE-664 CWE-664 at MITRE
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Uncontrolled Resource Consumption CWE-400
102
(39.8%)
Improper Initialization CWE-665
65
(25.4%)
Exposure of Resource to Wrong Sphere CWE-668
24
(9.4%)
Use of Incorrectly-Resolved Name or Reference CWE-706
21
(8.2%)
Externally Controlled Reference to a Resource in Another Sphere CWE-610
14
(5.5%)
Improper Control of Dynamically-Managed Code Resources CWE-913
10
(3.9%)
Incorrect Access of Indexable Resource CWE-118
5
(2.0%)
Improper Resource Shutdown or Release CWE-404
4
(1.6%)
Improper Synchronization CWE-662
4
(1.6%)
Incorrect Resource Transfer Between Spheres CWE-669
2
(0.8%)
Insecure Storage of Sensitive Information CWE-922
2
(0.8%)
Non-Equivalent Data Transformation CWE-1474
2
(0.8%)
Operation on Resource in Wrong Phase of Lifetime CWE-666
1
(0.4%)
Information Loss or Omission CWE-221
0
(0.0%)
Incomplete Internal State Distinction CWE-372
0
(0.0%)
Insufficient Resource Pool CWE-410
0
(0.0%)
Modification of Assumed-Immutable Data (MAID) CWE-471
0
(0.0%)
Reliance on Package-level Scope CWE-487
0
(0.0%)
Trust Boundary Violation CWE-501
0
(0.0%)
clone() Method Without super.clone() CWE-580
0
(0.0%)
External Influence of Sphere Definition CWE-673
0
(0.0%)
Improper Update of Reference Count CWE-911
0
(0.0%)
Creation of Emergent Resource CWE-1229
0
(0.0%)
Improper Preservation of Consistency Between Independent Representations of Shared State CWE-1250
0
(0.0%)
Reliance on Component That is Not Updateable CWE-1329
0
(0.0%)
Generation of Credential with Long Expiration CWE-1472
0
(0.0%)
Improper Expiration of Cached Data CWE-1473
0
(0.0%)
Incomplete Data/State Propagation CWE-1475
0
(0.0%)
CVEs
CVEs for Improper Control of a Resource Through its Lifetime CWE-664
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| Host filesystem path disclosure via DNS rebinding | CVE-2026-109823 | 2026-10-27 | |
| Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose | CVE-2026-65630 | 2026-10-26 | |
| erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | CVE-2026-65631 | 2026-10-26 | |
| Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 | CVE-2026-65627 | 2026-10-26 | |
| Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose | CVE-2026-65626 | 2026-10-26 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | CVE-2026-113440 | 2026-10-26 | |
| SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | CVE-2026-115700 | 2026-10-26 | |
| SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit | CVE-2026-108529 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit | CVE-2026-109584 | 2026-10-26 | |
| HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit | CVE-2026-111103 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| Quadratic bignum parsing of Content-Length and Host port values in Bandit | CVE-2026-113436 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | CVE-2026-105963 | 2026-10-23 | |
| Unbounded SAML message decompression in esaml allows memory exhaustion | CVE-2026-93471 | 2026-10-22 | |
| Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | CVE-2026-86696 | 2026-10-22 | |
| Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | CVE-2026-105270 | 2026-10-22 | |
| HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit | CVE-2026-105659 | 2026-10-14 | |
| Path traversal in Gleam via unvalidated package application names |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-103061 | 2026-10-12 |
25 per page ·
188 CVEs