Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Protection Mechanism Failure CWE-693 CWE-693 at MITRE
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Insufficient Verification of Data Authenticity CWE-345
12
(50.0%)
Missing Encryption of Sensitive Data CWE-311
2
(8.3%)
Use of Insufficiently Random Values CWE-330
2
(8.3%)
Improper Protection of Alternate Path CWE-424
2
(8.3%)
Inadequate Encryption Strength CWE-326
1
(4.2%)
Use of a Broken or Risky Cryptographic Algorithm CWE-327
1
(4.2%)
Client-Side Enforcement of Server-Side Security CWE-602
1
(4.2%)
Improper Isolation or Compartmentalization CWE-653
1
(4.2%)
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') CWE-757
1
(4.2%)
Reliance on Untrusted Inputs in a Security Decision CWE-807
1
(4.2%)
Incomplete List of Disallowed Inputs CWE-184
0
(0.0%)
Insufficient UI Warning of Dangerous Operations CWE-357
0
(0.0%)
Improperly Implemented Security Check for Standard CWE-358
0
(0.0%)
Reliance on a Single Factor in a Security Decision CWE-654
0
(0.0%)
Insufficient Psychological Acceptability CWE-655
0
(0.0%)
Reliance on Security Through Obscurity CWE-656
0
(0.0%)
Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism CWE-1039
0
(0.0%)
Semiconductor Defects in Hardware Logic with Security-Sensitive Implications CWE-1248
0
(0.0%)
Incorrect Selection of Fuse Values CWE-1253
0
(0.0%)
Product Released in Non-Release Configuration CWE-1269
0
(0.0%)
Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques CWE-1278
0
(0.0%)
Public Key Re-Use for Signing both Debug and Production Code CWE-1291
0
(0.0%)
Missing Support for Security Features in On-chip Fabrics or Buses CWE-1318
0
(0.0%)
Improper Protection against Electromagnetic Fault Injection (EM-FI) CWE-1319
0
(0.0%)
Missing Immutable Root of Trust in Hardware CWE-1326
0
(0.0%)
Improper Protections Against Hardware Overheating CWE-1338
0
(0.0%)
CVEs
CVEs for Protection Mechanism Failure CWE-693
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Token revocation record built from unverified JWT claims in AshAuthentication | CVE-2026-78223 | 2026-09-17 | |
| Reversible IP address pseudonymisation in AshAuthentication audit log hash mode | CVE-2026-82759 | 2026-09-17 | |
| AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | CVE-2026-82586 | 2026-09-07 | |
| ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | CVE-2026-82754 | 2026-09-07 | |
| AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | CVE-2026-81852 | 2026-08-31 | |
| AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain | CVE-2026-75757 | 2026-08-31 | |
| MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header | CVE-2026-81315 | 2026-08-31 | |
| Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc | CVE-2026-75759 | 2026-08-30 | |
| Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions | CVE-2026-77970 | 2026-08-30 | |
| Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail | CVE-2026-75847 | 2026-08-30 | |
| Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses | CVE-2026-53425 | 2026-08-20 | |
| Livebook Teams identity callback lacks state binding, allowing login CSRF |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66885 | 2026-08-05 |
| JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66298 | 2026-08-05 |
| Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection | CVE-2026-66884 | 2026-08-04 | |
| Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation | CVE-2026-55735 | 2026-08-01 | |
| Boruta dynamic client registration allows creation of over-privileged OAuth clients | CVE-2026-65635 | 2026-07-30 | |
| Insufficient verification of Hex package metadata in Gleam |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-59247 | 2026-07-29 |
| TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication |
Erlang
Erlang / ssl
|
CVE-2026-55953 | 2026-07-27 |
| Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl |
Erlang
Erlang / ssl
|
CVE-2026-54891 | 2026-07-02 |
| gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection | CVE-2026-43972 | 2026-06-08 | |
| Client-supplied URI scheme trusted without transport verification in bandit | CVE-2026-39807 | 2026-05-01 | |
| Lockfile checksums not verified in Hex allows dependency integrity bypass |
Hex Mix Integration
|
CVE-2026-32148 | 2026-04-30 |
| Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver |
Erlang / kernel
|
CVE-2026-28810 | 2026-04-07 |
23 CVEs