Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1003
Switch view
CWE-1003 at MITRE

We're looking at the CWE hierarchy through the Weaknesses for Simplified Mapping of Published Vulnerabilities view.

Uncontrolled Resource Consumption: 46 CVEs (35.7%) — click to drill down Use of Incorrectly-Resolved Name or Reference: 10 CVEs (7.8%) — click to drill down Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): 9 CVEs (7.0%) — click to drill down Improper Authentication: 8 CVEs (6.2%) — click to drill down Incorrect Authorization: 8 CVEs (6.2%) — click to drill down Externally Controlled Reference to a Resource in Another Sphere: 6 CVEs (4.7%) — click to drill down Improper Input Validation: 5 CVEs (3.9%) — click to drill down Insufficient Verification of Data Authenticity: 5 CVEs (3.9%) — click to drill down Interpretation Conflict: 5 CVEs (3.9%) — click to drill down Inefficient Algorithmic Complexity: 4 CVEs (3.1%) — click to drill down Operation on a Resource after Expiration or Release: 3 CVEs (2.3%) — click to drill down Excessive Iteration: 3 CVEs (2.3%) — click to drill down Improper Encoding or Escaping of Output: 2 CVEs (1.6%) — click to drill down Improper Restriction of Operations within the Bounds of a Memory Buffer: 2 CVEs (1.6%) — click to drill down Uncontrolled Recursion: 2 CVEs (1.6%) — click to drill down Improper Control of Dynamically-Managed Code Resources: 2 CVEs (1.6%) — click to drill down Exposure of Sensitive Information to an Unauthorized Actor: 1 CVEs (0.8%) — click to drill down Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): 1 CVEs (0.8%) — click to drill down Improper Resource Shutdown or Release: 1 CVEs (0.8%) — click to drill down Exposure of Resource to Wrong Sphere: 1 CVEs (0.8%) — click to drill down Incorrect Resource Transfer Between Spheres: 1 CVEs (0.8%) — click to drill down Incorrect Calculation: 1 CVEs (0.8%) — click to drill down Improper Check for Unusual or Exceptional Conditions: 1 CVEs (0.8%) — click to drill down Improper Handling of Exceptional Conditions: 1 CVEs (0.8%) — click to drill down Missing Authorization: 1 CVEs (0.8%) — click to drill down Improper Privilege Management: 0 CVEs (0.0%) — click to drill down Missing Encryption of Sensitive Data: 0 CVEs (0.0%) — click to drill down Inadequate Encryption Strength: 0 CVEs (0.0%) — click to drill down Use of a Broken or Risky Cryptographic Algorithm: 0 CVEs (0.0%) — click to drill down Use of Insufficiently Random Values: 0 CVEs (0.0%) — click to drill down Improper Synchronization: 0 CVEs (0.0%) — click to drill down Improper Initialization: 0 CVEs (0.0%) — click to drill down Always-Incorrect Control Flow Implementation: 0 CVEs (0.0%) — click to drill down Incorrect Comparison: 0 CVEs (0.0%) — click to drill down Incorrect Type Conversion or Cast: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Insecure Storage of Sensitive Information: 0 CVEs (0.0%) — click to drill down Total 121
Uncontrolled Resource Consumption CWE-400 46 (35.7%) Use of Incorrectly-Resolved Name or Reference CWE-706 10 (7.8%) Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74 9 (7.0%) Improper Authentication CWE-287 8 (6.2%) Incorrect Authorization CWE-863 8 (6.2%) Externally Controlled Reference to a Resource in Another Sphere CWE-610 6 (4.7%) Improper Input Validation CWE-20 5 (3.9%) Insufficient Verification of Data Authenticity CWE-345 5 (3.9%) Interpretation Conflict CWE-436 5 (3.9%) Inefficient Algorithmic Complexity CWE-407 4 (3.1%) Operation on a Resource after Expiration or Release CWE-672 3 (2.3%) Excessive Iteration CWE-834 3 (2.3%) Improper Encoding or Escaping of Output CWE-116 2 (1.6%) Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 2 (1.6%) Uncontrolled Recursion CWE-674 2 (1.6%) Improper Control of Dynamically-Managed Code Resources CWE-913 2 (1.6%) Exposure of Sensitive Information to an Unauthorized Actor CWE-200 1 (0.8%) Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-362 1 (0.8%) Improper Resource Shutdown or Release CWE-404 1 (0.8%) Exposure of Resource to Wrong Sphere CWE-668 1 (0.8%) Incorrect Resource Transfer Between Spheres CWE-669 1 (0.8%) Incorrect Calculation CWE-682 1 (0.8%) Improper Check for Unusual or Exceptional Conditions CWE-754 1 (0.8%) Improper Handling of Exceptional Conditions CWE-755 1 (0.8%) Missing Authorization CWE-862 1 (0.8%) Improper Privilege Management CWE-269 0 (0.0%) Missing Encryption of Sensitive Data CWE-311 0 (0.0%) Inadequate Encryption Strength CWE-326 0 (0.0%) Use of a Broken or Risky Cryptographic Algorithm CWE-327 0 (0.0%) Use of Insufficiently Random Values CWE-330 0 (0.0%) Improper Synchronization CWE-662 0 (0.0%) Improper Initialization CWE-665 0 (0.0%) Always-Incorrect Control Flow Implementation CWE-670 0 (0.0%) Incorrect Comparison CWE-697 0 (0.0%) Incorrect Type Conversion or Cast CWE-704 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Insecure Storage of Sensitive Information CWE-922 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Reflected XSS in oaskit's default HTML error handler
Hex / oaskit
GitHub / lud/oaskit
CVE-2026-66296 2026-08-03
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55734 2026-08-01
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55733 2026-08-01
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-54894 2026-08-01
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55735 2026-08-01
Boruta accepts expired JWT client assertions due to missing exp claim validation
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-54885 2026-07-30
Insufficient verification of Hex package metadata in Gleam
Gleam
GitHub / gleam-lang/gleam
ghcr.io / gleam-lang/gleam
CVE-2026-59247 2026-07-29
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
Hex / cowboy
GitHub / ninenines/cowboy
CVE-2026-65624 2026-07-28
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Hex / cowlib
GitHub / ninenines/cowlib
CVE-2026-59248 2026-07-28
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
Erlang / erts
GitHub / erlang/otp
CVE-2026-54890 2026-07-27
Denial of service via exponential certificate policy tree growth in path validation
Erlang / public_key
GitHub / erlang/otp
CVE-2026-59251 2026-07-27
Megaco flex scanner buffer overflow via oversized property parm name
Erlang / megaco
GitHub / erlang/otp
CVE-2026-59250 2026-07-27
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Erlang / erts
GitHub / erlang/otp
CVE-2026-55737 2026-07-27
epmd permanent DoS via EMFILE on accept(2) in erts
Erlang / erts
GitHub / erlang/otp
CVE-2026-42792 2026-07-27
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Erlang / ssl
GitHub / erlang/otp
CVE-2026-58227 2026-07-27
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
Hex / bandit
GitHub / mtrudel/bandit
CVE-2026-65623 2026-07-24
Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
Hex / mpp
GitHub / zenhive/mpp
CVE-2026-59252 2026-07-17
Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
Hex / mpp
GitHub / zenhive/mpp
CVE-2026-59694 2026-07-17
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
Hex / mpp
GitHub / zenhive/mpp
CVE-2026-59695 2026-07-17
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
Hex / mint
GitHub / elixir-mint/mint
CVE-2026-59249 2026-07-16
Missing ID token claim validation in ueberauth_apple allows account takeover
Hex / ueberauth_apple
GitHub / ueberauth/ueberauth_apple
CVE-2026-55954 2026-07-14
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
Hex / mint
GitHub / elixir-mint/mint
CVE-2026-59246 2026-07-14
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
Hex / mint
GitHub / elixir-mint/mint
CVE-2026-58229 2026-07-14
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
Hex / phoenix_live_view
GitHub / phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
25 per page · 121 CVEs
Page of 5