Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1200
Switch view
CWE-1200 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors view.
Uncontrolled Resource Consumption CWE-400
19
(22.6%)
Improper Limitation of a Pathname to a Restricted Directory CWE-22
12
(14.3%)
Improper Neutralization of Input During Web Page Generation CWE-79
11
(13.1%)
Improper Certificate Validation CWE-295
10
(11.9%)
Improper Input Validation CWE-20
5
(6.0%)
Deserialization of Untrusted Data CWE-502
5
(6.0%)
Improper Neutralization of Special Elements used in an SQL Command CWE-89
4
(4.8%)
Improper Authentication CWE-287
4
(4.8%)
Improper Control of Generation of Code CWE-94
2
(2.4%)
Integer Overflow or Wraparound CWE-190
2
(2.4%)
Exposure of Sensitive Information to an Unauthorized Actor CWE-200
2
(2.4%)
Cross-Site Request Forgery CWE-352
2
(2.4%)
Missing Release of Resource after Effective Lifetime CWE-772
2
(2.4%)
Out-of-bounds Write CWE-787
2
(2.4%)
Improper Neutralization of Special Elements used in an OS Command CWE-78
1
(1.2%)
Improper Restriction of XML External Entity Reference CWE-611
1
(1.2%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
0
(0.0%)
Out-of-bounds Read CWE-125
0
(0.0%)
Improper Privilege Management CWE-269
0
(0.0%)
Use After Free CWE-416
0
(0.0%)
Untrusted Search Path CWE-426
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
NULL Pointer Dereference CWE-476
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Use of Hard-coded Credentials CWE-798
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CVE-2026-115693 | 2026-10-26 | |
| WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers | CVE-2026-107685 | 2026-10-23 | |
| TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries |
Erlang
Erlang / ssl
|
CVE-2026-105236 | 2026-10-14 |
| HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit | CVE-2026-105659 | 2026-10-14 | |
| Path traversal in Gleam via unvalidated package application names |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-103061 | 2026-10-12 |
| Path traversal in rebar3 via unvalidated dependency app names |
rebar3
|
CVE-2026-103060 | 2026-10-12 |
| Path traversal in Hex via unvalidated dependency app names |
Hex Mix Integration
|
CVE-2026-96612 | 2026-10-12 |
| Hex trusts its bundled CA certificates when cacerts_path is set |
Hex Mix Integration
|
CVE-2026-103503 | 2026-10-12 |
| hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | CVE-2026-103502 | 2026-10-12 | |
| beam_mcp: nested tool argument constraints advertised but not enforced | CVE-2026-88257 | 2026-10-08 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 | |
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint | CVE-2026-82758 | 2026-09-07 | |
| httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
Erlang
pkg:otp/inets
|
CVE-2026-69664 | 2026-09-01 |
| A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer |
Erlang
pkg:otp/erts
|
CVE-2026-75538 | 2026-09-01 |
| httpd applies no timeout while receiving a request body, parking a worker on a stalled client |
Erlang
pkg:otp/inets
|
CVE-2026-71380 | 2026-09-01 |
| Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads | CVE-2026-82743 | 2026-09-01 | |
| Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory | CVE-2026-82742 | 2026-09-01 | |
| Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs | CVE-2026-82740 | 2026-09-01 | |
| Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service | CVE-2026-82738 | 2026-09-01 | |
| Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads | CVE-2026-82737 | 2026-09-01 | |
| Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service | CVE-2026-82735 | 2026-09-01 |
25 per page ·
82 CVEs