Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Allocation of Resources Without Limits or Throttling CWE-770 CWE-770 at MITRE
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CVEs
CVEs for Allocation of Resources Without Limits or Throttling CWE-770
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | CVE-2026-86696 | 2026-10-22 | |
| Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | CVE-2026-105270 | 2026-10-22 | |
| Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
Hex Mix Integration
|
CVE-2026-96618 | 2026-10-12 |
| Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash | CVE-2026-94201 | 2026-10-05 | |
| Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size | CVE-2026-92103 | 2026-09-28 | |
| HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory | CVE-2026-91043 | 2026-09-28 | |
| SSH daemon allocates unbounded idle session channels, bypassing max_channels |
Erlang
pkg:otp/ssh
|
CVE-2026-68956 | 2026-09-22 |
| Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server | CVE-2026-82753 | 2026-09-07 | |
| Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS | CVE-2026-82728 | 2026-09-04 | |
| inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception |
Erlang
pkg:otp/inets
|
CVE-2026-74835 | 2026-09-01 |
| httpc memory exhaustion via unbounded response header accumulation |
Erlang
pkg:otp/inets
|
CVE-2026-55951 | 2026-09-01 |
| httpd does not enforce the documented default max_clients connection limit |
Erlang
pkg:otp/inets
|
CVE-2026-70399 | 2026-09-01 |
| Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter | CVE-2026-74837 | 2026-09-01 | |
| Unbounded atom creation from typed struct field names in AshTypescript field selector | CVE-2026-77856 | 2026-09-01 | |
| AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) | CVE-2026-82722 | 2026-08-31 | |
| Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service | CVE-2026-81636 | 2026-08-30 | |
| HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit | CVE-2026-74836 | 2026-08-20 | |
| Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain | CVE-2026-73541 | 2026-08-19 |