Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Neutralization CWE-707 CWE-707 at MITRE
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74
34
(50.7%)
Improper Input Validation CWE-20
21
(31.3%)
Improper Encoding or Escaping of Output CWE-116
7
(10.4%)
Improper Neutralization of Special Elements CWE-138
4
(6.0%)
Encoding Error CWE-172
1
(1.5%)
Improper Null Termination CWE-170
0
(0.0%)
Collapse of Data into Unsafe Value CWE-182
0
(0.0%)
Improper Handling of Syntactically Invalid Structure CWE-228
0
(0.0%)
Improper Handling of Inconsistent Structural Elements CWE-240
0
(0.0%)
Deletion of Data Structure Sentinel CWE-463
0
(0.0%)
Improper Validation of Generative AI Output CWE-1426
0
(0.0%)
CVEs
CVEs for Improper Neutralization CWE-707
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Log injection via an unescaped password reset identity in AshAuthentication | CVE-2026-86522 | 2026-09-17 | |
| mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot | CVE-2026-88255 | 2026-09-16 | |
| Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata | CVE-2026-82710 | 2026-09-08 | |
| Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata | CVE-2026-82584 | 2026-09-07 | |
| Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry | CVE-2026-81638 | 2026-09-07 | |
| ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection | CVE-2026-82756 | 2026-09-07 | |
| Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation | CVE-2026-82750 | 2026-09-06 | |
| Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning | CVE-2026-82751 | 2026-09-06 | |
| Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length | CVE-2026-82752 | 2026-09-05 | |
| eldap does not bound the port component of a referral URL before integer conversion |
Erlang
pkg:otp/eldap
|
CVE-2026-70409 | 2026-09-01 |
| snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields |
Erlang
pkg:otp/snmp
|
CVE-2026-70405 | 2026-09-01 |
| httpd mod_auth directory protection bypassed by a doubled slash in the request path |
Erlang
pkg:otp/inets
|
CVE-2026-66835 | 2026-09-01 |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| uri_string does not bound the port component of a URI before integer conversion |
Erlang
pkg:otp/stdlib
|
CVE-2026-59696 | 2026-09-01 |
| httpc does not bound server-supplied numeric header values before integer conversion |
Erlang
pkg:otp/inets
|
CVE-2026-71562 | 2026-09-01 |
| Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion | CVE-2026-82741 | 2026-09-01 | |
| Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs | CVE-2026-82740 | 2026-09-01 | |
| Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service | CVE-2026-82738 | 2026-09-01 | |
| Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass | CVE-2026-82736 | 2026-09-01 | |
| Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal | CVE-2026-82734 | 2026-09-01 | |
| Declared argument constraints not enforced on AshTypescript typed controller routes | CVE-2026-82732 | 2026-09-01 | |
| Query-parameter injection in AshAdmin row-action links via unencoded string primary keys | CVE-2026-82681 | 2026-08-31 | |
| Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | CVE-2026-77850 | 2026-08-31 | |
| EEx template evaluation of prompt content in AshAi enables remote code execution | CVE-2026-77956 | 2026-08-31 | |
| Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment | CVE-2026-81633 | 2026-08-30 |
25 per page ·
67 CVEs