Exposure of Erlang
Programming languages97
exposure score
2,076
sites use
1
exploited
3
critical
CVEs
67 resultsCVE-2025-32433CRITICALErlang/OTP SSH Vulnerable to Pre-Authentication RCEEPSS 98.9%KEVCVE-2026-66835HIGHhttpd mod_auth directory protection bypassed by a doubled slash in the request pathEPSS 1.0%CVE-2026-69664HIGHhttpd parks a request worker indefinitely on a malformed chunk size sent after the headersEPSS 0.9%CVE-2026-70399HIGHhttpd does not enforce the documented default max_clients connection limitEPSS 0.9%CVE-2026-73270HIGHhttpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemsEPSS 0.9%CVE-2026-75538HIGHA Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated PeerEPSS 0.9%CVE-2026-59250HIGHMegaco flex scanner buffer overflow via oversized property parm nameEPSS 0.8%CVE-2026-59696MEDIUMuri_string does not bound the port component of a URI before integer conversionEPSS 0.7%CVE-2026-70405MEDIUMsnmp BER INTEGER decoder applies no size limit to attacker-supplied integer fieldsEPSS 0.7%CVE-2026-55951HIGHhttpc memory exhaustion via unbounded response header accumulationEPSS 0.7%CVE-2026-23943MEDIUMPre-auth SSH DoS via unbounded zlib inflateEPSS 0.7%CVE-2026-71380HIGHhttpd applies no timeout while receiving a request body, parking a worker on a stalled clientEPSS 0.7%CVE-2026-21619LOWUnsafe Deserialization of Erlang Terms in hex_coreEPSS 0.6%CVE-2026-74994MEDIUMinets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authEPSS 0.6%CVE-2026-74835HIGHinets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body ReceptionEPSS 0.6%CVE-2026-66357HIGHinets,httpd:HTTP Request Smuggling via obs-fold Header ContinuationEPSS 0.6%CVE-2026-73276HIGHinets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping iEPSS 0.6%CVE-2026-70409MEDIUMeldap does not bound the port component of a referral URL before integer conversionEPSS 0.6%CVE-2026-71562MEDIUMhttpc does not bound server-supplied numeric header values before integer conversionEPSS 0.6%CVE-2026-28808HIGHScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)EPSS 0.6%