Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1435
Switch view
CWE-1435 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses view.
Allocation of Resources Without Limits or Throttling CWE-770
62
(41.3%)
Incorrect Authorization CWE-863
22
(14.7%)
Improper Limitation of a Pathname to a Restricted Directory CWE-22
12
(8.0%)
Improper Neutralization of Input During Web Page Generation CWE-79
11
(7.3%)
Authorization Bypass Through User-Controlled Key CWE-639
7
(4.7%)
Server-Side Request Forgery CWE-918
6
(4.0%)
Improper Input Validation CWE-20
5
(3.3%)
Deserialization of Untrusted Data CWE-502
5
(3.3%)
Improper Neutralization of Special Elements used in an SQL Command CWE-89
4
(2.7%)
Improper Control of Generation of Code CWE-94
2
(1.3%)
Stack-based Buffer Overflow CWE-121
2
(1.3%)
Exposure of Sensitive Information to an Unauthorized Actor CWE-200
2
(1.3%)
Cross-Site Request Forgery CWE-352
2
(1.3%)
Out-of-bounds Write CWE-787
2
(1.3%)
Missing Authorization CWE-862
2
(1.3%)
Improper Neutralization of Special Elements used in an OS Command CWE-78
1
(0.7%)
Buffer Copy without Checking Size of Input CWE-120
1
(0.7%)
Heap-based Buffer Overflow CWE-122
1
(0.7%)
Improper Access Control CWE-284
1
(0.7%)
Improper Neutralization of Special Elements used in a Command CWE-77
0
(0.0%)
Out-of-bounds Read CWE-125
0
(0.0%)
Missing Authentication for Critical Functionality CWE-306
0
(0.0%)
Use After Free CWE-416
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
NULL Pointer Dereference CWE-476
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | CVE-2026-115700 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | CVE-2026-96581 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 | |
| Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records | CVE-2026-114214 | 2026-10-25 | |
| Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | CVE-2026-86696 | 2026-10-22 | |
| Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | CVE-2026-105270 | 2026-10-22 | |
| Path traversal in Gleam via unvalidated package application names |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-103061 | 2026-10-12 |
| Path traversal in rebar3 via unvalidated dependency app names |
rebar3
|
CVE-2026-103060 | 2026-10-12 |
| Path traversal in Hex via unvalidated dependency app names |
Hex Mix Integration
|
CVE-2026-96612 | 2026-10-12 |
| Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
Hex Mix Integration
|
CVE-2026-96618 | 2026-10-12 |
| Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts | CVE-2026-101028 | 2026-10-09 | |
| beam_mcp: nested tool argument constraints advertised but not enforced | CVE-2026-88257 | 2026-10-08 | |
| Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash | CVE-2026-94201 | 2026-10-05 | |
| Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size | CVE-2026-92103 | 2026-09-28 | |
| HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory | CVE-2026-91043 | 2026-09-28 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 |
25 per page ·
147 CVEs