Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Neutralization CWE-707 CWE-707 at MITRE
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.
Improper Neutralization of Special Elements in Output Used by a Downstream Component CWE-74
37
(48.1%)
Improper Input Validation CWE-20
27
(35.1%)
Improper Encoding or Escaping of Output CWE-116
7
(9.1%)
Improper Neutralization of Special Elements CWE-138
5
(6.5%)
Improper Encoding or Decoding of Data CWE-172
1
(1.3%)
Improper Null Termination CWE-170
0
(0.0%)
Improper Handling of Syntactically Invalid Structure CWE-228
0
(0.0%)
Improper Handling of Inconsistent Structural Elements CWE-240
0
(0.0%)
Deletion of Data Structure Sentinel CWE-463
0
(0.0%)
Improper Validation of Generative AI Output CWE-1426
0
(0.0%)
CVEs
CVEs for Improper Neutralization CWE-707
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-115274 | 2026-10-30 |
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | CVE-2026-112880 | 2026-10-26 | |
| Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit | CVE-2026-105660 | 2026-10-15 | |
| TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl |
Erlang
Erlang / ssl
|
CVE-2026-94200 | 2026-10-14 |
| Terminal escape sequence injection in Hex via unneutralized server-supplied output |
Hex Mix Integration
|
CVE-2026-81856 | 2026-10-12 |
| beam_mcp: nested tool argument constraints advertised but not enforced | CVE-2026-88257 | 2026-10-08 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 | |
| Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free | CVE-2026-89420 | 2026-09-22 | |
| Log injection via an unescaped password reset identity in AshAuthentication | CVE-2026-86522 | 2026-09-17 | |
| mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot | CVE-2026-88255 | 2026-09-16 | |
| Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata | CVE-2026-82710 | 2026-09-08 | |
| Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata | CVE-2026-82584 | 2026-09-07 | |
| Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry | CVE-2026-81638 | 2026-09-07 | |
| ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection | CVE-2026-82756 | 2026-09-07 | |
| Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation | CVE-2026-82750 | 2026-09-06 | |
| Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning | CVE-2026-82751 | 2026-09-06 | |
| Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length | CVE-2026-82752 | 2026-09-05 | |
| eldap does not bound the port component of a referral URL before integer conversion |
Erlang
pkg:otp/eldap
|
CVE-2026-70409 | 2026-09-01 |
| snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields |
Erlang
pkg:otp/snmp
|
CVE-2026-70405 | 2026-09-01 |
| httpd mod_auth directory protection bypassed by a doubled slash in the request path |
Erlang
pkg:otp/inets
|
CVE-2026-66835 | 2026-09-01 |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| uri_string does not bound the port component of a URI before integer conversion |
Erlang
pkg:otp/stdlib
|
CVE-2026-59696 | 2026-09-01 |
| httpc does not bound server-supplied numeric header values before integer conversion |
Erlang
pkg:otp/inets
|
CVE-2026-71562 | 2026-09-01 |
25 per page ·
77 CVEs