Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1460
Switch view
CWE-1460 at MITRE

We're looking at the CWE hierarchy through the Weaknesses Addressed by the Top 20 Secure PLC Coding Practices view.

Improper Validation of Integrity Check Value: 3 CVEs (25.0%) — click to drill down Integer Overflow or Wraparound: 2 CVEs (16.7%) — click to drill down Insufficient Verification of Data Authenticity: 2 CVEs (16.7%) — click to drill down Improper Check for Unusual or Exceptional Conditions: 2 CVEs (16.7%) — click to drill down Out-of-bounds Write: 2 CVEs (16.7%) — click to drill down Improper Isolation or Compartmentalization: 1 CVEs (8.3%) — click to drill down Wrap-around Error: 0 CVEs (0.0%) — click to drill down Improper Validation of Array Index: 0 CVEs (0.0%) — click to drill down Missing Support for Integrity Check: 0 CVEs (0.0%) — click to drill down Divide By Zero: 0 CVEs (0.0%) — click to drill down Insufficient Logging: 0 CVEs (0.0%) — click to drill down Excessive Code Complexity: 0 CVEs (0.0%) — click to drill down Improper Protection for Outbound Error Messages and Alert Signals: 0 CVEs (0.0%) — click to drill down Total 12
Improper Validation of Integrity Check Value CWE-354 3 (25.0%) Integer Overflow or Wraparound CWE-190 2 (16.7%) Insufficient Verification of Data Authenticity CWE-345 2 (16.7%) Improper Check for Unusual or Exceptional Conditions CWE-754 2 (16.7%) Out-of-bounds Write CWE-787 2 (16.7%) Improper Isolation or Compartmentalization CWE-653 1 (8.3%) Wrap-around Error CWE-128 0 (0.0%) Improper Validation of Array Index CWE-129 0 (0.0%) Missing Support for Integrity Check CWE-353 0 (0.0%) Divide By Zero CWE-369 0 (0.0%) Insufficient Logging CWE-778 0 (0.0%) Excessive Code Complexity CWE-1120 0 (0.0%) Improper Protection for Outbound Error Messages and Alert Signals CWE-1320 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not
Hex / jsv
GitHub / lud/jsv
CVE-2026-117680 2026-11-01
Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
Hex / jose
GitHub / potatosalad/erlang-jose
CVE-2026-65625 2026-10-26
Hex writes unverified package tarballs to standard output in mix hex.package fetch
Hex Mix Integration
GitHub / hexpm/hex
CVE-2026-105280 2026-10-12
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
Erlang
pkg:otp/erts
GitHub / erlang/otp
CVE-2026-75538 2026-09-01
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
Hex / ash
GitHub / ash-project/ash
CVE-2026-82737 2026-09-01
Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
Hex / samly
GitHub / dropbox/samly
GitHub / handnot2/samly
CVE-2026-53425 2026-08-20
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-65635 2026-07-30
Insufficient verification of Hex package metadata in Gleam
Gleam
GitHub / gleam-lang/gleam
ghcr.io / gleam-lang/gleam
CVE-2026-59247 2026-07-29
Megaco flex scanner buffer overflow via oversized property parm name
Erlang
Erlang / megaco
GitHub / erlang/otp
CVE-2026-59250 2026-07-27
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Erlang / erts
GitHub / erlang/otp
CVE-2026-55737 2026-07-27
Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
Hex / phoenix
npm / phoenix
GitHub / phoenixframework/phoenix
CVE-2026-56812 2026-07-07
Lockfile checksums not verified in Hex allows dependency integrity bypass
Hex Mix Integration
GitHub / hexpm/hex
CVE-2026-32148 2026-04-30
12 CVEs