Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1003
Switch view
CWE-1003 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses for Simplified Mapping of Published Vulnerabilities view.
Uncontrolled Resource Consumption CWE-400
77
(24.3%)
Incorrect Authorization CWE-863
29
(9.1%)
Improper Authentication CWE-287
25
(7.9%)
Improper Input Validation CWE-20
21
(6.6%)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74
21
(6.6%)
Use of Incorrectly-Resolved Name or Reference CWE-706
17
(5.4%)
Insufficient Verification of Data Authenticity CWE-345
16
(5.0%)
Externally Controlled Reference to a Resource in Another Sphere CWE-610
14
(4.4%)
Exposure of Sensitive Information to an Unauthorized Actor CWE-200
13
(4.1%)
Inefficient Algorithmic Complexity CWE-407
13
(4.1%)
Interpretation Conflict CWE-436
12
(3.8%)
Operation on a Resource after Expiration or Release CWE-672
7
(2.2%)
Improper Encoding or Escaping of Output CWE-116
6
(1.9%)
Uncontrolled Recursion CWE-674
6
(1.9%)
Excessive Iteration CWE-834
6
(1.9%)
Improper Control of Dynamically-Managed Code Resources CWE-913
5
(1.6%)
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-362
4
(1.3%)
Improper Resource Shutdown or Release CWE-404
3
(0.9%)
Incorrect Resource Transfer Between Spheres CWE-669
3
(0.9%)
Incorrect Calculation CWE-682
3
(0.9%)
Improper Check for Unusual or Exceptional Conditions CWE-754
3
(0.9%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
2
(0.6%)
Missing Encryption of Sensitive Data CWE-311
2
(0.6%)
Use of a Broken or Risky Cryptographic Algorithm CWE-327
2
(0.6%)
Missing Authorization CWE-862
2
(0.6%)
Use of Insufficiently Random Values CWE-330
1
(0.3%)
Exposure of Resource to Wrong Sphere CWE-668
1
(0.3%)
Incorrect Comparison CWE-697
1
(0.3%)
Incorrect Type Conversion or Cast CWE-704
1
(0.3%)
Improper Handling of Exceptional Conditions CWE-755
1
(0.3%)
Improper Privilege Management CWE-269
0
(0.0%)
Inadequate Encryption Strength CWE-326
0
(0.0%)
Improper Synchronization CWE-662
0
(0.0%)
Improper Initialization CWE-665
0
(0.0%)
Always-Incorrect Control Flow Implementation CWE-670
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Insecure Storage of Sensitive Information CWE-922
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not | CVE-2026-117680 | 2026-11-01 | |
| Unverified Sign in with Apple callback parameter can override verified ID token claims | CVE-2026-117656 | 2026-10-30 | |
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-115274 | 2026-10-30 |
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| ECDSA signature length is not validated in jose, allowing signature malleability | CVE-2026-65632 | 2026-10-26 | |
| erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | CVE-2026-65631 | 2026-10-26 | |
| Weak PBKDF2 parameters for password-encrypted private-key export in jose | CVE-2026-65629 | 2026-10-26 | |
| Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | CVE-2026-65628 | 2026-10-26 | |
| Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose | CVE-2026-65626 | 2026-10-26 | |
| Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose | CVE-2026-65625 | 2026-10-26 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CVE-2026-115693 | 2026-10-26 | |
| HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | CVE-2026-113440 | 2026-10-26 | |
| SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | CVE-2026-115700 | 2026-10-26 | |
| SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit | CVE-2026-108529 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| Quadratic bignum parsing of Content-Length and Host port values in Bandit | CVE-2026-113436 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit | CVE-2026-114216 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | CVE-2026-96581 | 2026-10-26 |
25 per page ·
305 CVEs