VulnSea

Tagged “erlang”

CVEs tagged erlang, newest first.

48 CVEsRSS

GHSA-vv77-66rf-pm86High
1mo ago

mpp vulnerable to Gas Draining with no limit

mpp vulnerable to Gas Draining with no limit

▾ Twilightmpp · mppvia GHSA
GHSA-qpxh-ff8m-c62vMedium
1mo ago

mpp vulnerable to Gas Draining with access list

mpp vulnerable to Gas Draining with access list

▾ Sunlitmpp · mppvia GHSA
GHSA-vj8p-hp9x-gh47High
1mo ago

mpp vulnerable to Gas Draining with low gas limit

mpp vulnerable to Gas Draining with low gas limit

▾ Twilightmpp · mppvia GHSA
CVE-2026-55736Medium
1mo ago

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

▾ Sunlitash · ashEPSS 0.37%via GHSA
CVE-2026-54892High
1mo ago

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

▾ Twilightplug · plugEPSS 0.95%via GHSA
CVE-2026-54451High· 8.2PoC
1mo ago

Elixir protobuf is a pure Elixir implementation of Google Protobuf

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential o…

▾ Midnightelixir-protobuf · protobufEPSS 0.52%via NVD
CVE-2026-53430High
2mo ago

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

▾ Twilightgrpc · grpcEPSS 0.52%via GHSA
CVE-2026-49757CriticalPoC
2mo ago

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

▾ Abyssalash_authentication · ash_authenticationEPSS 0.68%via GHSA
CVE-2026-53423Medium
2mo ago

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

▾ Sunlitmembrane_mp4_plugin · membrane_mp4_pluginEPSS 0.18%via GHSA
CVE-2026-49457Critical· 9.1
2mo ago

erlang_quic is a pure Erlang QUIC implementation

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not valida…

▾ Midnightquic · quicEPSS 0.25%via NVD
CVE-2026-49755High
3mo ago

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

▾ Twilightreq · reqEPSS 0.70%via GHSA
CVE-2026-49756Medium
3mo ago

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

▾ Sunlitreq · reqEPSS 0.34%via GHSA
CVE-2026-48861Low
3mo ago

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

▾ Sunlitmint · mintEPSS 0.22%via GHSA
CVE-2026-49753Medium
3mo ago

mint: Content-Length header accepts non-RFC "+" sign prefix

mint: Content-Length header accepts non-RFC "+" sign prefix

▾ Sunlitmint · mintEPSS 0.52%via GHSA
CVE-2026-49754High
3mo ago

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

▾ Twilightmint · mintEPSS 0.52%via GHSA
CVE-2026-48862High
3mo ago

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

▾ Twilightmint · mintEPSS 0.52%via GHSA
CVE-2026-56812High· 7.5PoC
3mo ago

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every…

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every…

▾ Midnightphoenixframework · phoenixEPSS 0.80%via NVD
CVE-2026-56811High· 7.5
3mo ago

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with…

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with…

▾ Twilightphoenixframework · phoenixEPSS 0.78%via NVD
CVE-2026-54893Low· 2.1
3mo ago

URL path injection in the Microsoft Graph adapter of Swoosh

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encodi…

▾ Sunlitswoosh · swooshEPSS 0.20%via NVD
CVE-2026-48593Medium
3mo ago

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

▾ Sunlitoban_web · oban_webEPSS 0.47%via GHSA
CVE-2026-48592Medium
3mo ago

oban_web missing authorization check on `save-job` event handler

oban_web missing authorization check on `save-job` event handler

▾ Sunlitoban_web · oban_webEPSS 0.56%via GHSA
CVE-2026-47077High
4mo ago

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

▾ Twilighthackney · hackneyEPSS 0.70%via GHSA
CVE-2026-49454Critical· 9.1
4mo ago

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

▾ Midnightrelyra · relyraEPSS 0.23%via GHSA
CVE-2026-47066High
4mo ago

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

▾ Twilighthackney · hackneyEPSS 0.70%via GHSA
CVE-2026-47071High
4mo ago

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

▾ Twilighthackney · hackneyEPSS 0.70%via GHSA
CVE-2026-47076Medium
4mo ago

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

▾ Sunlithackney · hackneyEPSS 0.16%via GHSA
CVE-2026-47069Low
4mo ago

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

▾ Sunlithackney · hackneyEPSS 0.36%via GHSA
CVE-2026-47070Medium
4mo ago

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

▾ Sunlithackney · hackneyEPSS 0.35%via GHSA
CVE-2026-47074High
4mo ago

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

▾ Twilighthackney · hackneyEPSS 0.38%via GHSA
CVE-2026-47075Medium
4mo ago

Hackney has CR/LF injection in query parameter

Hackney has CR/LF injection in query parameter

▾ Sunlithackney · hackneyEPSS 0.42%via GHSA
CVEs tagged “erlang” · VulnSea