Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-884
Switch view
CWE-884 at MITRE
Switch view
We're looking at the CWE hierarchy through the CWE Cross-section view.
Allocation of Resources Without Limits or Throttling CWE-770
62
(24.5%)
Incorrect Authorization CWE-863
22
(8.7%)
Uncontrolled Resource Consumption CWE-400
19
(7.5%)
Improper Limitation of a Pathname to a Restricted Directory CWE-22
12
(4.7%)
Inefficient Algorithmic Complexity CWE-407
12
(4.7%)
Improper Neutralization of Input During Web Page Generation CWE-79
11
(4.3%)
Improper Handling of Highly Compressed Data (Data Amplification) CWE-409
11
(4.3%)
Inconsistent Interpretation of HTTP Requests CWE-444
10
(4.0%)
Generation of Error Message Containing Sensitive Information CWE-209
8
(3.2%)
URL Redirection to Untrusted Site CWE-601
6
(2.4%)
Uncontrolled Recursion CWE-674
6
(2.4%)
Loop with Unreachable Exit Condition CWE-835
6
(2.4%)
Authentication Bypass by Spoofing CWE-290
5
(2.0%)
Authentication Bypass by Capture-replay CWE-294
5
(2.0%)
Improper Verification of Cryptographic Signature CWE-347
5
(2.0%)
Deserialization of Untrusted Data CWE-502
5
(2.0%)
Improper Neutralization of Special Elements used in an SQL Command CWE-89
4
(1.6%)
Time-of-check Time-of-use (TOCTOU) Race Condition CWE-367
4
(1.6%)
Relative Path Traversal CWE-23
3
(1.2%)
Improper Neutralization of CRLF Sequences in HTTP Headers CWE-113
3
(1.2%)
Improper Validation of Integrity Check Value CWE-354
3
(1.2%)
Improper Control of Generation of Code CWE-94
2
(0.8%)
Integer Overflow or Wraparound CWE-190
2
(0.8%)
Cleartext Storage of Sensitive Information CWE-312
2
(0.8%)
Cross-Site Request Forgery CWE-352
2
(0.8%)
Missing Release of Resource after Effective Lifetime CWE-772
2
(0.8%)
Missing Authorization CWE-862
2
(0.8%)
Improper Link Resolution Before File Access CWE-59
1
(0.4%)
Improper Neutralization of Special Elements used in an OS Command CWE-78
1
(0.4%)
Improper Output Neutralization for Logs CWE-117
1
(0.4%)
Buffer Copy without Checking Size of Input CWE-120
1
(0.4%)
Improper Handling of Alternate Encoding CWE-173
1
(0.4%)
Integer Underflow (Wrap or Wraparound) CWE-191
1
(0.4%)
Observable Discrepancy CWE-203
1
(0.4%)
Unchecked Return Value CWE-252
1
(0.4%)
Improper Following of a Certificate's Chain of Trust CWE-296
1
(0.4%)
Key Exchange without Entity Authentication CWE-322
1
(0.4%)
Acceptance of Extraneous Untrusted Data With Trusted Data CWE-349
1
(0.4%)
Download of Code Without Integrity Check CWE-494
1
(0.4%)
Insufficiently Protected Credentials CWE-522
1
(0.4%)
Client-Side Enforcement of Server-Side Security CWE-602
1
(0.4%)
Operation on a Resource after Expiration or Release CWE-672
1
(0.4%)
Reliance on Untrusted Inputs in a Security Decision CWE-807
1
(0.4%)
Inclusion of Functionality from Untrusted Control Sphere CWE-829
1
(0.4%)
Inappropriate Encoding for Output Context CWE-838
1
(0.4%)
Improper Enforcement of Behavioral Workflow CWE-841
1
(0.4%)
Compiler Removal of Code to Clear Buffers CWE-14
0
(0.0%)
Absolute Path Traversal CWE-36
0
(0.0%)
Improper Resolution of Path Equivalence CWE-41
0
(0.0%)
Improper Neutralization of Argument Delimiters in a Command CWE-88
0
(0.0%)
Improper Neutralization of Special Elements used in an LDAP Query CWE-90
0
(0.0%)
Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95
0
(0.0%)
Improper Neutralization of Directives in Statically Saved Code CWE-96
0
(0.0%)
Improper Control of Resource Identifiers CWE-99
0
(0.0%)
Improper Validation of Array Index CWE-129
0
(0.0%)
Incorrect Calculation of Buffer Size CWE-131
0
(0.0%)
Use of Externally-Controlled Format String CWE-134
0
(0.0%)
Incorrect Calculation of Multi-Byte String Length CWE-135
0
(0.0%)
Improper Null Termination CWE-170
0
(0.0%)
Double Decoding of the Same Data CWE-174
0
(0.0%)
Improper Handling of Mixed Encoding CWE-175
0
(0.0%)
Incorrect Behavior Order: Early Validation CWE-179
0
(0.0%)
Incorrect Regular Expression CWE-185
0
(0.0%)
Off-by-one Error CWE-193
0
(0.0%)
Improper Removal of Sensitive Information Before Storage or Transfer CWE-212
0
(0.0%)
Truncation of Security-relevant Information CWE-222
0
(0.0%)
Omission of Security-relevant Information CWE-223
0
(0.0%)
Improper Handling of Syntactically Invalid Structure CWE-228
0
(0.0%)
Improper Clearing of Heap Memory Before Release CWE-244
0
(0.0%)
Uncaught Exception CWE-248
0
(0.0%)
Execution with Unnecessary Privileges CWE-250
0
(0.0%)
Incorrect Check of Function Return Value CWE-253
0
(0.0%)
Not Using Password Aging CWE-262
0
(0.0%)
Password Aging with Long Expiration CWE-263
0
(0.0%)
Incorrect Privilege Assignment CWE-266
0
(0.0%)
Privilege Defined With Unsafe Actions CWE-267
0
(0.0%)
Privilege Chaining CWE-268
0
(0.0%)
Privilege Context Switching Error CWE-270
0
(0.0%)
Privilege Dropping / Lowering Errors CWE-271
0
(0.0%)
Improper Check for Dropped Privileges CWE-273
0
(0.0%)
Unverified Ownership CWE-283
0
(0.0%)
Improper Check for Certificate Revocation CWE-299
0
(0.0%)
Channel Accessible by Non-Endpoint CWE-300
0
(0.0%)
Reflection Attack in an Authentication Protocol CWE-301
0
(0.0%)
Missing Critical Step in Authentication CWE-304
0
(0.0%)
Missing Authentication for Critical Functionality CWE-306
0
(0.0%)
Improper Restriction of Excessive Authentication Attempts CWE-307
0
(0.0%)
Use of Single-factor Authentication CWE-308
0
(0.0%)
Cleartext Transmission of Sensitive Information CWE-319
0
(0.0%)
Reusing a Nonce, Key Pair in Encryption CWE-323
0
(0.0%)
Missing Cryptographic Step CWE-325
0
(0.0%)
Use of a Broken or Risky Cryptographic Algorithm CWE-327
0
(0.0%)
Insufficient Entropy CWE-331
0
(0.0%)
Small Space of Random Values CWE-334
0
(0.0%)
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) CWE-335
0
(0.0%)
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CWE-338
0
(0.0%)
Predictable from Observable State CWE-341
0
(0.0%)
Use of Less Trusted Source CWE-348
0
(0.0%)
Missing Support for Integrity Check CWE-353
0
(0.0%)
Signal Handler Race Condition CWE-364
0
(0.0%)
Divide By Zero CWE-369
0
(0.0%)
Detection of Error Condition Without Action CWE-390
0
(0.0%)
Missing Report of Error Condition CWE-392
0
(0.0%)
Return of Wrong Status Code CWE-393
0
(0.0%)
Insufficient Control of Network Message Volume (Network Amplification) CWE-406
0
(0.0%)
Incorrect Behavior Order: Early Amplification CWE-408
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
User Interface (UI) Misrepresentation of Critical Information CWE-451
0
(0.0%)
Insecure Default Variable Initialization CWE-453
0
(0.0%)
External Initialization of Trusted Variables or Data Stores CWE-454
0
(0.0%)
Non-exit on Failed Initialization CWE-455
0
(0.0%)
Missing Initialization of a Variable CWE-456
0
(0.0%)
Use of sizeof() on a Pointer Type CWE-467
0
(0.0%)
Incorrect Pointer Scaling CWE-468
0
(0.0%)
Use of Pointer Subtraction to Determine Size CWE-469
0
(0.0%)
Use of Externally-Controlled Input to Select Classes or Code CWE-470
0
(0.0%)
NULL Pointer Dereference CWE-476
0
(0.0%)
Missing Default Case in Multiple Condition Expression CWE-478
0
(0.0%)
Use of Incorrect Operator CWE-480
0
(0.0%)
Incorrect Block Delimitation CWE-483
0
(0.0%)
Omitted Break Statement in Switch CWE-484
0
(0.0%)
Comparison of Classes by Name CWE-486
0
(0.0%)
Private Data Structure Returned From A Public Method CWE-495
0
(0.0%)
Public Data Assigned to Private Array-Typed Field CWE-496
0
(0.0%)
Cloneable Class Containing Sensitive Information CWE-498
0
(0.0%)
Serializable Class Containing Sensitive Data CWE-499
0
(0.0%)
Weak Password Requirements CWE-521
0
(0.0%)
Suspicious Comment CWE-546
0
(0.0%)
Use of Hard-coded, Security-relevant Constants CWE-547
0
(0.0%)
Dead Code CWE-561
0
(0.0%)
Assignment to Variable without Use CWE-563
0
(0.0%)
Unsynchronized Access to Shared Data in a Multithreaded Context CWE-567
0
(0.0%)
Assignment of a Fixed Address to a Pointer CWE-587
0
(0.0%)
Comparison of Object References Instead of Object Contents CWE-595
0
(0.0%)
Multiple Binds to the Same Port CWE-605
0
(0.0%)
Reachable Assertion CWE-617
0
(0.0%)
Variable Extraction Error CWE-621
0
(0.0%)
Dynamic Variable Evaluation CWE-627
0
(0.0%)
Function Call with Incorrectly Specified Arguments CWE-628
0
(0.0%)
External Control of Critical State Data CWE-642
0
(0.0%)
Incorrect Use of Privileged APIs CWE-648
0
(0.0%)
Improper Locking CWE-667
0
(0.0%)
Use of Potentially Dangerous Function CWE-676
0
(0.0%)
Incorrect Conversion between Numeric Types CWE-681
0
(0.0%)
Execution After Redirect (EAR) CWE-698
0
(0.0%)
Incorrect Ownership Assignment CWE-708
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Missing Custom Error Page CWE-756
0
(0.0%)
Release of Invalid Pointer or Reference CWE-763
0
(0.0%)
Operator Precedence Logic Error CWE-783
0
(0.0%)
Access of Memory Location Before Start of Buffer CWE-786
0
(0.0%)
Access of Memory Location After End of Buffer CWE-788
0
(0.0%)
Use of Hard-coded Credentials CWE-798
0
(0.0%)
Buffer Access with Incorrect Length Value CWE-805
0
(0.0%)
Untrusted Pointer Dereference CWE-822
0
(0.0%)
Expired Pointer Dereference CWE-825
0
(0.0%)
Numeric Range Comparison Without Minimum Check CWE-839
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Unverified Sign in with Apple callback parameter can override verified ID token claims | CVE-2026-117656 | 2026-10-30 | |
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
Elixir
|
CVE-2026-109821 | 2026-10-30 |
| HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit | CVE-2026-116078 | 2026-10-28 | |
| ECDSA signature length is not validated in jose, allowing signature malleability | CVE-2026-65632 | 2026-10-26 | |
| erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service | CVE-2026-65631 | 2026-10-26 | |
| Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types | CVE-2026-65628 | 2026-10-26 | |
| Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 | CVE-2026-65627 | 2026-10-26 | |
| Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose | CVE-2026-65626 | 2026-10-26 | |
| Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose | CVE-2026-65625 | 2026-10-26 | |
| Unbounded response body buffering and decompression in hackney | CVE-2026-97200 | 2026-10-26 | |
| HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | CVE-2026-113440 | 2026-10-26 | |
| CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney | CVE-2026-112880 | 2026-10-26 | |
| SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit | CVE-2026-108529 | 2026-10-26 | |
| Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit | CVE-2026-110499 | 2026-10-26 | |
| HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit | CVE-2026-109584 | 2026-10-26 | |
| HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit | CVE-2026-111101 | 2026-10-26 | |
| Quadratic bignum parsing of Content-Length and Host port values in Bandit | CVE-2026-113436 | 2026-10-26 | |
| WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit | CVE-2026-110314 | 2026-10-26 | |
| WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit | CVE-2026-114213 | 2026-10-26 | |
| Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit | CVE-2026-114216 | 2026-10-26 | |
| HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | CVE-2026-115269 | 2026-10-26 | |
| HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit | CVE-2026-108525 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 |
25 per page ·
240 CVEs