E
Vendor security profile1 actively exploited CVEs
erlang
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs51
Critical3
CISA KEV1
Public exploit2
Patch rate%98
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
3
4
3
7
14
0
19
0
CVE KEV
CVE severity distribution
51toplam CVE
Critical3 (6%)
High27 (53%)
Medium17 (33%)
Low3 (6%)
Uncertain1 (2%)
Patch and exploitation view
%98
Verified patch
%2
CISA KEV
%4
Public exploit
49Patch available
1Partial
1Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
8.2
CVE-2026-65634
Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
E
Patch verifiedEPSS %0
7.1
CVE-2026-68956
SSH daemon allocates unbounded idle session channels, bypassing max_channels
E
Patch verifiedEPSS %0
9.3
CVE-2026-89422
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
E
Patch verifiedEPSS %0
8.7
CVE-2026-69664
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
E
Patch verifiedEPSS %1
6.3
CVE-2026-70409
eldap does not bound the port component of a referral URL before integer conversion
E
Patch verifiedEPSS %1
6.3
CVE-2026-70405
snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
E
Patch verifiedEPSS %1
8.2
CVE-2026-66835
httpd mod_auth directory protection bypassed by a doubled slash in the request path
E
Patch verifiedEPSS %1
8.2
CVE-2026-73270
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
E
Patch verifiedEPSS %1
8.2
CVE-2026-75538
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
E
Patch verifiedEPSS %1
6.0
CVE-2026-74994
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
E
Patch verifiedEPSS %1