Erlang OTP vulnerabilities

In Erlang OTP (inets module), an incorrect authorization vulnerability exists. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory access controls against the DocumentRoot path while mod_cgi executes the script at the ScriptAlias path. This mismatch allows unauthenticated access to CGI scripts protected by directory rules.

In Erlang OTP (inets httpd module), an HTTP Request Smuggling vulnerability exists. The server does not reject or normalize duplicate Content-Length headers. The first value is used, while common proxies use the last, enabling front-end/back-end desynchronization and injection of attacker-controlled bytes as the start of the next request.

An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.

A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.

The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.

In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.

A vulnerability in the External Term Format (ETF) decoder in ERTS causes an integer underflow when processing crafted binary data. This leads to allocating huge memory and crashing the entire Erlang/VM node.

In the zip module of Erlang OTP stdlib, a relative path traversal vulnerability allows writing files outside the intended extraction directory via a crafted zip archive. The zip:check_dir_level/2 function improperly validates paths containing ../ sequences.

In Erlang OTP (epmd), a connection slot exhaustion vulnerability allows an unauthenticated remote attacker to permanently terminate the epmd daemon. The do_accept function incorrectly treats EMFILE/ENFILE errors as fatal instead of recoverable.

Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.

TOCTOU race condition in the ssl module (dtls_packet_demux) in Erlang/OTP. An unauthenticated remote attacker can send multiple ClientHello messages from the same source, causing a race and crash of the demux process, terminating all active DTLS sessions on that listener. The attack is repeatable and requires no authentication.

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute a valid DTLS cookie before the first rotation of the cookie secret.

A stack-based buffer overflow exists in the erl_interface library of Erlang OTP in the ei_s_print_term function. It uses a 2000-character stack buffer that can overflow when formatting very large integers. Overflow bytes are limited to ASCII 0-9 and A-F, restricting exploitation to Denial of Service.

Stack-based buffer overflow in the inet_drv driver of Erlang OTP. An unauthenticated remote attacker can send a crafted SCTP ERROR chunk, crashing the BEAM VM.

Erlang/OTP ssl (inet_tls_dist) uses inet:sockname/1 instead of inet:peername/1 in check_ip/1, causing the LAN allowlist to be bypassed. Any holder of a CA-signed TLS certificate can bypass the LAN restriction and gain full Erlang node access.

SSRF vulnerability in Erlang/OTP FTP module allows an attacker to redirect the data connection to any internal host and port via an unvalidated PASV response. The flaw exists in the default configuration (passive mode, IPv4, no FTP extensions) and enables FTP bounce attacks and internal network scanning.

Erlang OTP inets (httpc_response module) before patched versions does not check origin boundaries during redirects. The httpc client forwards Authorization and Proxy-Authorization headers to redirect targets without verifying whether the redirect crosses an origin boundary. An attacker controlling a server contacted by the victim via httpc can issue a cross-origin 3xx redirect to another server, stealing credentials.

In the ssh_sftpd module of Erlang OTP SSH, there is an information disclosure vulnerability. The SSH_FXP_READLINK handler sends the raw result of file:read_link/2 to the client without calling chroot_filename/2, revealing the absolute filesystem path of the SFTP root directory and symlink targets.

A vulnerability in Erlang OTP's public_key module (pubkey_ocsp) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. The validity period of the OCSP responder certificate is not checked.

Improper certificate validation in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass due to missing signature verification. An attacker can intercept OCSP responses and forge them to mark revoked certificates as valid.

Vulnerability in Erlang/OTP DNS module (inet_res, inet_db) allows DNS cache poisoning. It uses a sequential, process-global 16-bit transaction ID without source port randomization, making it easy for an attacker to predict the ID and inject forged responses.

Erlang OTP SSH (ssh_transport module) advertises legacy zlib compression by default, allowing a decompression bomb attack pre-authentication. Each SSH packet can decompress ~255 MB from 256 KB of data (1029:1 ratio), leading to memory exhaustion and DoS. Affects OTP from 17.0 before 28.4.1, 27.3.4.9, and 26.2.5.18.

The ssh_sftpd module in Erlang OTP before OTP 28.4.1, 27.3.4.9, and 26.2.5.18 uses string prefix matching instead of proper path component validation. Authenticated users can access sibling directories that share a common name prefix with the configured root directory.

Erlang/OTP has a relative path traversal vulnerability in the tftp_file modules, allowing access to files outside the intended directory. This affects OTP versions from 17.0 before 28.3.2, 27.3.4.8, and 26.2.5.17.

Resource exhaustion vulnerability in the SSH module of Erlang OTP (ssh_sftp) allows an attacker to perform a flooding attack. The issue affects the file lib/ssh/src/ssh_sftpd.erl and occurs in OTP versions 17.0 through 28.0.3, 27.3.4.3, and 26.2.5.15.

In OTP SSH (ssh_sftp modules) before certain versions, there is an uncontrolled resource consumption vulnerability leading to excessive allocation and flooding. The vulnerability is in the file lib/ssh/src/ssh_sftpd.erl.

The ssh_sftp module in Erlang OTP before OTP 28.0.3, 27.3.4.3, and 26.2.5.15 does not limit resource allocation, allowing excessive allocation and resource leak. The vulnerability is in lib/ssh/src/ssh_sftpd.erl.

The ssh_sftp module in Erlang OTP before OTP 28.0.3, 27.3.4.3, and 26.2.5.15 does not limit resource allocation, allowing excessive allocation and resource leak. The vulnerability is in lib/ssh/src/ssh_sftpd.erl.