Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
151 vulnerabilities
CVE-2026-55734 (GCVE-0-2026-55734)
Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:49
VLAI
EPSS
VEX
Title
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/guardian/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55734.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55734 | related |
| https://github.com/ueberauth/guardian/commit/8d4e… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:49:36.457207Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:49:59.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions\u0027"
],
"packageName": "guardian",
"packageURL": "pkg:hex/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
},
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
},
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions\u0027"
],
"packageName": "ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1"
},
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2"
},
{
"name": "\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "8d4efbfc352d30f5fcfc75a4d69a795b0e472724",
"status": "affected",
"version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis vulnerability is only exploitable in applications that use \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e (via \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e) and route attacker-influenced data into \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, for example by reading a permissions map from a request body and passing it into token issuance.\u003c/p\u003e"
}
],
"value": "This vulnerability is only exploitable in applications that use Guardian.Permissions (via use Guardian.Permissions) and route attacker-influenced data into encode_permissions!/1 or encode_permissions_into_claims!/2, for example by reading a permissions map from a request body and passing it into token issuance."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Yordis Prieto"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (\u003ctt\u003eGuardian.Permissions\u003c/tt\u003e module) allows a denial of service via BEAM atom-table exhaustion.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/guardian/permissions.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eGuardian.Permissions\u003c/tt\u003e mixin installs a public \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e function on every module that does \u003ctt\u003euse Guardian.Permissions\u003c/tt\u003e. For each key of the supplied map, \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e calls \u003ctt\u003eString.to_atom(to_string(k))\u003c/tt\u003e before any validation runs. The integer-value clause of \u003ctt\u003edo_encode_permissions!/2\u003c/tt\u003e then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e (for example a permissions map read from a request body and passed into token issuance via \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling \u003ctt\u003edecode_permissions/1\u003c/tt\u003e is not affected because it skips keys absent from the configured permission set.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.\n\nThis vulnerability is associated with program file lib/guardian/permissions.ex and program routines \u0027Elixir.Guardian.Permissions\u0027:encode_permissions!/1, \u0027Elixir.Guardian.Permissions\u0027:encode_permissions_into_claims!/2, \u0027Elixir.Guardian.Permissions\u0027:do_encode_permissions!/2.\n\nThe Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T18:46:24.291Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55734.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55734"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e472724"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBefore calling \u003ctt\u003eencode_permissions!/1\u003c/tt\u003e or \u003ctt\u003eencode_permissions_into_claims!/2\u003c/tt\u003e, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions.\u003c/p\u003e"
}
],
"value": "Before calling encode_permissions!/1 or encode_permissions_into_claims!/2, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55734",
"datePublished": "2026-08-01T18:46:24.291Z",
"dateReserved": "2026-06-17T10:44:34.365Z",
"dateUpdated": "2026-08-03T16:49:59.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55733 (GCVE-0-2026-55733)
Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 16:50
VLAI
EPSS
VEX
Title
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Summary
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.
Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.
String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.
The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.
This issue affects guardian: from 2.0.0 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/guardian/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55733.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55733 | related |
| https://github.com/ueberauth/guardian/commit/9cd2… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55733",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T16:50:27.758398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:50:53.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
],
"packageName": "guardian",
"packageURL": "pkg:hex/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
},
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
],
"packageName": "ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
},
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "9cd268557846aa4c3ad53566c08f2c190ee5513f",
"status": "affected",
"version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly applications that opt into the non-default \u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encoder (via \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e) and pass attacker-influenced permission scopes into its \u003ctt\u003eencode/3\u003c/tt\u003e entry point are exploitable. The default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e encoder and the \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e encoder do not create atoms and are not affected.\u003c/p\u003e"
}
],
"value": "Only applications that opt into the non-default Guardian.Permissions.AtomEncoding encoder (via use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding) and pass attacker-influenced permission scopes into its encode/3 entry point are exploitable. The default Guardian.Permissions.BitwiseEncoding encoder and the Guardian.Permissions.TextEncoding encoder do not create atoms and are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Yordis Prieto"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encodes permission scopes by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. When \u003ctt\u003eencode/3\u003c/tt\u003e in \u003ctt\u003elib/guardian/permissions/atom_encoding.ex\u003c/tt\u003e is called with a list, each binary entry is handled by the \u003ctt\u003eencode_value/3\u003c/tt\u003e binary clause, which calls \u003ctt\u003eString.to_atom(value)\u003c/tt\u003e with no allow-list check. The \u003ctt\u003eperm_set\u003c/tt\u003e argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e and reached through the imported \u003ctt\u003eencode/3\u003c/tt\u003e entry point.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into \u003ctt\u003eencode/3\u003c/tt\u003e therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with \u003ctt\u003esystem_limit\u003c/tt\u003e, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThe default encoder is \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e, which is not affected.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T18:46:12.113Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55733.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55733"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSwitch the permission encoder to the default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e or to \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e, neither of which creates atoms. Alternatively, validate every permission value against the configured \u003ctt\u003eperm_set\u003c/tt\u003e allowlist (rejecting unknown values) before passing it to \u003ctt\u003eencode/3\u003c/tt\u003e.\u003c/p\u003e"
}
],
"value": "Switch the permission encoder to the default Guardian.Permissions.BitwiseEncoding or to Guardian.Permissions.TextEncoding, neither of which creates atoms. Alternatively, validate every permission value against the configured perm_set allowlist (rejecting unknown values) before passing it to encode/3."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55733",
"datePublished": "2026-08-01T18:46:12.113Z",
"dateReserved": "2026-06-17T10:44:34.365Z",
"dateUpdated": "2026-08-03T16:50:53.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54894 (GCVE-0-2026-54894)
Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-03 17:49
VLAI
EPSS
VEX
Title
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Summary
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.
Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.
String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.
This issue affects guardian: from 0.1.0 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/guardian/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54894.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54894 | related |
| https://github.com/ueberauth/guardian/commit/2952… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54894",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:49:32.217048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:49:54.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Plug.Keys\u0027"
],
"packageName": "guardian",
"packageURL": "pkg:hex/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/plug/keys.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Plug.Keys\u0027"
],
"packageName": "ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/plug/keys.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:base_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:claims_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:resource_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:token_key/1"
},
{
"name": "\u0027Elixir.Guardian.Plug.Keys\u0027:key_from_other/1"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2952657e42e6341a67e6aaad09d8f0b40ae917cb",
"status": "affected",
"version": "7126fa433afc2563fcac0c9aa35193965f8fd5f8",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the \u003ctt\u003e:key\u003c/tt\u003e option to entry points like \u003ctt\u003eGuardian.Plug.current_token/2\u003c/tt\u003e. Applications that use a static namespace (the default \u003ctt\u003e:default\u003c/tt\u003e key or hardcoded atoms) are not affected.\u003c/p\u003e"
}
],
"value": "Only applications that derive a Guardian key (the conn/session namespace) from attacker-influenced data are exploitable. This is the case when a caller-supplied value such as a tenant identifier, request header, or other request input is passed as the :key option to entry points like Guardian.Plug.current_token/2. Applications that use a static namespace (the default :default key or hardcoded atoms) are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Yordis Prieto"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Plug.Keys\u003c/tt\u003e derives connection and session namespace keys by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. \u003ctt\u003ebase_key/1\u003c/tt\u003e in \u003ctt\u003elib/guardian/plug/keys.ex\u003c/tt\u003e converts any binary into the atom \u003ctt\u003e:\"guardian_\u0026lt;input\u0026gt;\"\u003c/tt\u003e, and the derived helpers \u003ctt\u003eclaims_key/1\u003c/tt\u003e, \u003ctt\u003eresource_key/1\u003c/tt\u003e, and \u003ctt\u003etoken_key/1\u003c/tt\u003e create a second atom on top of that. \u003ctt\u003ekey_from_other/1\u003c/tt\u003e likewise converts a regex-captured binary through \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. The public specs advertise \u003ctt\u003eString.t()\u003c/tt\u003e as a valid argument, so passing a string is documented usage, and higher-level entry points such as \u003ctt\u003eGuardian.Plug.current_token(conn, key: key)\u003c/tt\u003e thread the caller-supplied key straight into these functions.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 0.1.0 before 2.4.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\n\nGuardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :\"guardian_\u003cinput\u003e\", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\n\nThis issue affects guardian: from 0.1.0 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T18:46:05.861Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54894.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54894"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDo not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the \u003ctt\u003e:key\u003c/tt\u003e option.\u003c/p\u003e"
}
],
"value": "Do not derive Guardian keys from untrusted input. Use a fixed, hardcoded set of namespace keys, or validate the value against a bounded allowlist of known keys, before passing it as the :key option."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54894",
"datePublished": "2026-08-01T18:46:05.861Z",
"dateReserved": "2026-06-16T10:47:13.915Z",
"dateUpdated": "2026-08-03T17:49:54.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55735 (GCVE-0-2026-55735)
Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-01 18:46
VLAI
EPSS
VEX
Title
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Summary
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.
Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.
An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.
This issue affects guardian: from 1.0.0 before 2.4.1.
Severity
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/guardian/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55735.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55735 | related |
| https://github.com/ueberauth/guardian/commit/2bd7… | patch |
Impacted products
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian\u0027"
],
"packageName": "guardian",
"packageURL": "pkg:hex/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian\u0027:revoke/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian\u0027"
],
"packageName": "ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian\u0027:revoke/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2bd7a8c29770d423d855c0a4965caa6c3e486901",
"status": "affected",
"version": "d65227145f72b290106c06cecbe42728fbf05fe2",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application must route a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (for example a logout or session-revocation endpoint) and use a token module whose \u003ctt\u003erevoke\u003c/tt\u003e / \u003ctt\u003eon_revoke\u003c/tt\u003e callback mutates state keyed by the token claims (a whitelist that deletes by \u003ctt\u003ejti\u003c/tt\u003e or a blacklist that inserts by \u003ctt\u003ejti\u003c/tt\u003e, such as a GuardianDb-style store). With the default no-op \u003ctt\u003eon_revoke\u003c/tt\u003e callback, no session state is changed and the issue is not exploitable.\u003c/p\u003e"
}
],
"value": "The application must route a caller-supplied token into Guardian.revoke/3 (for example a logout or session-revocation endpoint) and use a token module whose revoke / on_revoke callback mutates state keyed by the token claims (a whitelist that deletes by jti or a blacklist that inserts by jti, such as a GuardianDb-style store). With the default no-op on_revoke callback, no session state is changed and the issue is not exploitable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Yordis Prieto"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e in \u003ctt\u003elib/guardian.ex\u003c/tt\u003e decodes the supplied token with \u003ctt\u003epeek/1\u003c/tt\u003e, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s \u003ctt\u003erevoke\u003c/tt\u003e callback and the implementation\u0027s \u003ctt\u003eon_revoke\u003c/tt\u003e callback, a state-mutating sink. The sibling operations \u003ctt\u003erefresh/2\u003c/tt\u003e and \u003ctt\u003eexchange/4\u003c/tt\u003e both call \u003ctt\u003edecode_and_verify\u003c/tt\u003e first, so the signature is checked before anything acts on the claims; \u003ctt\u003erevoke/3\u003c/tt\u003e is the only state-mutating path that acts on claims without verifying the signature.\u003c/p\u003e\u003cp\u003eAn attacker who knows or guesses a victim\u0027s identifying claim values (\u003ctt\u003ejti\u003c/tt\u003e, \u003ctt\u003esub\u003c/tt\u003e) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 1.0.0 before 2.4.1.\u003c/p\u003e"
}
],
"value": "Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim\u0027s session with a forged token.\n\nGuardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module\u0027s revoke callback and the implementation\u0027s on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.\n\nAn attacker who knows or guesses a victim\u0027s identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim\u0027s legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\n\nThis issue affects guardian: from 1.0.0 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-475",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-475 Signature Spoofing by Improper Validation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T18:46:05.234Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55735.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55735"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/guardian/commit/2bd7a8c29770d423d855c0a4965caa6c3e486901"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVerify the token before revoking it: call \u003ctt\u003edecode_and_verify\u003c/tt\u003e (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into \u003ctt\u003eGuardian.revoke/3\u003c/tt\u003e. Reject tokens with an invalid signature at the application boundary.\u003c/p\u003e"
}
],
"value": "Verify the token before revoking it: call decode_and_verify (or a verify-without-expiry variant, so already-expired tokens remain revocable) on the caller-supplied token and pass only tokens whose signature validates into Guardian.revoke/3. Reject tokens with an invalid signature at the application boundary."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55735",
"datePublished": "2026-08-01T18:46:05.234Z",
"dateReserved": "2026-06-17T10:44:34.365Z",
"dateUpdated": "2026-08-01T18:46:05.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65636 (GCVE-0-2026-65636)
Vulnerability from cvelistv5 – Published: 2026-07-31 13:29 – Updated: 2026-08-01 04:18
VLAI
EPSS
VEX
Title
YAML injection via unescaped newlines in ymlr document comments
Summary
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.
An attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected.
This vulnerability is associated with program files lib/ymlr.ex and program routines 'Elixir.Ymlr':document!/2, 'Elixir.Ymlr':documents!/2.
This issue affects ymlr from 0.0.1 before 5.1.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ufirstgroup/ymlr/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65636.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65636 | related |
| https://github.com/ufirstgroup/ymlr/commit/7e5306… | patch |
| https://github.com/ufirstgroup/ymlr/commit/42a0bf… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ufirstgroup | ymlr |
Affected:
0.0.1 , < 5.1.6
(semver)
cpe:2.3:a:ufirstgroup:ymlr:*:*:*:*:*:*:*:* |
|
| ufirstgroup | ymlr |
Affected:
0c11a86de83825e91c27cecaccb03f36416d8fe0 , < 42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc
(git)
cpe:2.3:a:ufirstgroup:ymlr:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65636",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T14:28:31.525792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T14:28:44.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ufirstgroup:ymlr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Ymlr"
],
"packageName": "ymlr",
"packageURL": "pkg:hex/ymlr",
"product": "ymlr",
"programFiles": [
"lib/ymlr.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ymlr\u0027:document!/2"
},
{
"name": "\u0027Elixir.Ymlr\u0027:documents!/2"
}
],
"repo": "https://github.com/ufirstgroup/ymlr",
"vendor": "ufirstgroup",
"versions": [
{
"lessThan": "5.1.6",
"status": "affected",
"version": "0.0.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ufirstgroup:ymlr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Ymlr"
],
"packageName": "ufirstgroup/ymlr",
"packageURL": "pkg:github/ufirstgroup/ymlr",
"product": "ymlr",
"programFiles": [
"lib/ymlr.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ymlr\u0027:document!/2"
},
{
"name": "\u0027Elixir.Ymlr\u0027:documents!/2"
}
],
"repo": "https://github.com/ufirstgroup/ymlr",
"vendor": "ufirstgroup",
"versions": [
{
"lessThan": "42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc",
"status": "affected",
"version": "0c11a86de83825e91c27cecaccb03f36416d8fe0",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA deployment is vulnerable when the host application places attacker-controlled text in the comment position of a document, that is, as the first element of the \u003ctt\u003e{comment, data}\u003c/tt\u003e tuple passed to \u003ctt\u003eYmlr.document!/2\u003c/tt\u003e, \u003ctt\u003eYmlr.document/2\u003c/tt\u003e, \u003ctt\u003eYmlr.documents!/2\u003c/tt\u003e or \u003ctt\u003eYmlr.documents/2\u003c/tt\u003e. Callers that encode data without comments, or that use only static comment strings, are not exploitable.\u003c/p\u003e"
}
],
"value": "A deployment is vulnerable when the host application places attacker-controlled text in the comment position of a document, that is, as the first element of the {comment, data} tuple passed to Ymlr.document!/2, Ymlr.document/2, Ymlr.documents!/2 or Ymlr.documents/2. Callers that encode data without comments, or that use only static comment strings, are not exploitable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ufirstgroup:ymlr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.1.6",
"versionStartIncluding": "0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Michael Ruoss"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (\u003ctt\u003eElixir.Ymlr\u003c/tt\u003e module) allows attackers to inject arbitrary content into generated YAML documents through document comments. \u003ctt\u003eYmlr.document!/2\u003c/tt\u003e interpolates each caller-supplied comment string into the output behind a single \u003ctt\u003e#\u003c/tt\u003e prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.\u003c/p\u003e\u003cp\u003eAn attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit \u003ctt\u003e---\u003c/tt\u003e or \u003ctt\u003e...\u003c/tt\u003e markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs \u003ctt\u003eYmlr.document/2\u003c/tt\u003e, \u003ctt\u003eYmlr.documents!/2\u003c/tt\u003e and \u003ctt\u003eYmlr.documents/2\u003c/tt\u003e, so every document encoding entry point is affected.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/ymlr.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Ymlr\u0027:document!/2\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Ymlr\u0027:documents!/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects ymlr from 0.0.1 before 5.1.6.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single # prefix without validating it or escaping line breaks. Because a YAML comment is terminated by a line break, the first carriage return or line feed in the comment string ends the comment context and everything after it is emitted at column 0 of the document body.\n\nAn attacker who controls text that the host application passes as a comment can forge top-level mapping keys, override values the application itself set, and emit --- or ... markers that split the output into additional documents. Downstream consumers of the generated YAML, such as configuration loaders, deployment manifests, CI pipelines and data importers, parse the injected content as legitimate data. The same clause backs Ymlr.document/2, Ymlr.documents!/2 and Ymlr.documents/2, so every document encoding entry point is affected.\n\nThis vulnerability is associated with program files lib/ymlr.ex and program routines \u0027Elixir.Ymlr\u0027:document!/2, \u0027Elixir.Ymlr\u0027:documents!/2.\n\nThis issue affects ymlr from 0.0.1 before 5.1.6."
}
],
"impacts": [
{
"capecId": "CAPEC-15",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-15 Command Delimiters"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T04:18:38.726Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65636.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65636"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "YAML injection via unescaped newlines in ymlr document comments",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSplit any untrusted comment string on line breaks and pass the resulting list as the comment element of the \u003ctt\u003e{comment, data}\u003c/tt\u003e tuple. Ymlr prefixes every list element with its own \u003ctt\u003e#\u003c/tt\u003e marker, so no line can leave the comment context. Alternatively, reject comment strings that contain carriage return or line feed characters, or keep untrusted text out of comments entirely and place it in the encoded data instead, where the encoder quotes it.\u003c/p\u003e"
}
],
"value": "Split any untrusted comment string on line breaks and pass the resulting list as the comment element of the {comment, data} tuple. Ymlr prefixes every list element with its own # marker, so no line can leave the comment context. Alternatively, reject comment strings that contain carriage return or line feed characters, or keep untrusted text out of comments entirely and place it in the encoded data instead, where the encoder quotes it."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65636",
"datePublished": "2026-07-31T13:29:31.198Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-08-01T04:18:38.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53431 (GCVE-0-2026-53431)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta accepts expired JWT client assertions due to missing exp claim validation
Summary
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.
Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client's privileges.
This issue affects boruta: from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-53431.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-53431 | related |
| https://github.com/malach-it/boruta_auth/commit/5… | patch |
| https://github.com/malach-it/boruta_auth/commit/6… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53431",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:12:55.290055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:22.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/oauth/authorization/client.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_client_authentication/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1"
},
{
"name": "\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "5204f88f9b2cdd9637a755337ed5f99185be5474",
"status": "unaffected"
},
{
"at": "69363432aa36760fc5438e4e17115d0f7c1b925a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "5bfbe1c5443bffe71cf1bf954bbdff61327d9a83",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e or \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods). Deployments that authenticate clients only via \u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e are not exposed.\u003c/p\u003e"
}
],
"value": "The attack requires that the Boruta deployment has provisioned at least one OAuth client configured to authenticate via JWT client assertions (client_secret_jwt or private_key_jwt token endpoint authentication methods). Deployments that authenticate clients only via client_secret_basic or client_secret_post are not exposed."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\u003c/p\u003e\u003cp\u003eBoruta accepts JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e token endpoint authentication methods) but never enforces that the assertion\u0027s \u003ctt\u003eexp\u003c/tt\u003e claim is in the future. The pre-check helper \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:check_expiration/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e only verifies that an \u003ctt\u003eexp\u003c/tt\u003e claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Authorization.Client.Token\u0027:token_config/0\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/authorization/client.ex\u003c/tt\u003e, returns an empty map, so Joken\u0027s default \u003ctt\u003eexp\u003c/tt\u003e claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired.\n\nBoruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion\u0027s exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken\u0027s default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser tooling, or other observability surfaces) can replay it indefinitely to authenticate as the client and obtain access tokens with that client\u0027s privileges.\n\nThis issue affects boruta: from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:43.209Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-xjv8-vmh5-xhf6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-53431.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53431"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/5204f88f9b2cdd9637a755337ed5f99185be5474"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/69363432aa36760fc5438e4e17115d0f7c1b925a"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Boruta accepts expired JWT client assertions due to missing exp claim validation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the use of JWT-based client authentication (\u003ctt\u003eclient_secret_jwt\u003c/tt\u003e and \u003ctt\u003eprivate_key_jwt\u003c/tt\u003e) to highly trusted clients, and prefer non-JWT client authentication methods (\u003ctt\u003eclient_secret_basic\u003c/tt\u003e or \u003ctt\u003eclient_secret_post\u003c/tt\u003e) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay.\u003c/p\u003e"
}
],
"value": "Restrict the use of JWT-based client authentication (client_secret_jwt and private_key_jwt) to highly trusted clients, and prefer non-JWT client authentication methods (client_secret_basic or client_secret_post) where possible. Where JWT client authentication must remain enabled, issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems to reduce the window for replay."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-53431",
"datePublished": "2026-07-30T14:17:27.909Z",
"dateReserved": "2026-06-09T11:01:47.529Z",
"dateUpdated": "2026-07-31T04:20:43.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65635 (GCVE-0-2026-65635)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:17 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Boruta dynamic client registration allows creation of over-privileged OAuth clients
Summary
Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.
This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2.
This issue affects boruta from 2.3.0 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65635 | related |
| https://github.com/malach-it/boruta_auth/commit/8… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:13:41.629153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:13:59.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Boruta.Openid"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/openid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Openid\u0027:register_client/3"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "82584c854a332482232fd25301ab12a835f9f643",
"status": "unaffected"
},
{
"at": "95619a1beaff68fa766cca9b388e7c780d182525",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "85481b706636fe68a43d0b8d3275e2afc7f7fee1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA deployment is vulnerable when the host application exposes \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e from a public endpoint are not exploitable.\u003c/p\u003e"
}
],
"value": "A deployment is vulnerable when the host application exposes Boruta.Openid.register_client/3 on a network endpoint without requiring a trusted initial access token and without a strict server-side allowlist that prevents caller-supplied administrative attributes from reaching the underlying changeset. The standard controller generator does not install a dynamic client registration route, so deployments that never call Boruta.Openid.register_client/3 from a public endpoint are not exploitable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Isolation or Compartmentalization vulnerability in malach-it boruta (\u003ctt\u003eElixir.Boruta.Openid\u003c/tt\u003e module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:register_client/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects boruta from 2.3.0 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval.\n\nThis vulnerability is associated with program files lib/boruta/openid.ex and program routines \u0027Elixir.Boruta.Openid\u0027:register_client/3, \u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2.\n\nThis issue affects boruta from 2.3.0 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653 Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:15.914Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65635.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65635"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Boruta dynamic client registration allows creation of over-privileged OAuth clients",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to \u003ctt\u003eBoruta.Openid.register_client/3\u003c/tt\u003e directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function.\u003c/p\u003e"
}
],
"value": "Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, do not forward the request parameters to Boruta.Openid.register_client/3 directly. Instead, construct a new parameter map in the host application that contains only the standards-defined public metadata (such as redirect URIs, client name, logo, and contacts) and overwrite every administrative attribute (supported grant types, authorized scopes, PKCE flag, public refresh and revocation flags, token lifetimes, signing settings, token endpoint authentication method) with values from a fixed least-privilege server-side profile before calling the function."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65635",
"datePublished": "2026-07-30T14:17:02.942Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-07-31T04:20:15.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54885 (GCVE-0-2026-54885)
Vulnerability from cvelistv5 – Published: 2026-07-30 14:16 – Updated: 2026-07-31 04:20
VLAI
EPSS
VEX
Title
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Summary
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.
Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |> Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server's HTTP client at arbitrary network targets reachable from the Boruta host.
This issue affects boruta: from 2.3.2 before 2.3.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/malach-it/boruta_auth/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54885.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54885 | related |
| https://github.com/malach-it/boruta_auth/commit/0… | patch |
| https://github.com/malach-it/boruta_auth/commit/9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54885",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T16:14:18.216537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T16:14:32.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "boruta",
"packageURL": "pkg:hex/boruta",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"lessThan": "2.3.7",
"status": "affected",
"version": "2.3.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Boruta.Oauth.Request.Base\u0027",
"\u0027Elixir.Boruta.Openid\u0027",
"\u0027Elixir.Boruta.Ecto.Clients\u0027"
],
"packageName": "malach-it/boruta_auth",
"packageURL": "pkg:github/malach-it/boruta_auth",
"product": "boruta",
"programFiles": [
"lib/boruta/oauth/request/base.ex",
"lib/boruta/openid.ex",
"lib/boruta/adapters/ecto/clients.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1"
},
{
"name": "\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2"
},
{
"name": "\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1"
}
],
"repo": "https://github.com/malach-it/boruta_auth",
"vendor": "malach-it",
"versions": [
{
"changes": [
{
"at": "001e3dc5c259e67c6f907e98867eda4141c96d0d",
"status": "unaffected"
},
{
"at": "95fb10b78129355e475681f324c9a01ef0af2be5",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "15455b86206e0370eabd64c1856a5c996b436455",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:malach-it:boruta_auth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Pascal Knoth"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\u003c/p\u003e\u003cp\u003eThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. \u003ctt\u003e\u0027Elixir.Boruta.Oauth.Request.Base\u0027:fetch_unsigned_request/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/oauth/request/base.ex\u003c/tt\u003e dereferences the OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e parameter from the authorization request via \u003ctt\u003eFinch.build(:get, request_uri) |\u0026gt; Finch.request(OpenIDHttpClient)\u003c/tt\u003e. \u003ctt\u003e\u0027Elixir.Boruta.Openid\u0027:parse_registration_params/2\u003c/tt\u003e in \u003ctt\u003elib/boruta/openid.ex\u003c/tt\u003e dereferences the \u003ctt\u003ejwks_uri\u003c/tt\u003e supplied in an OpenID Connect dynamic client registration request. \u003ctt\u003e\u0027Elixir.Boruta.Ecto.Clients\u0027:refresh_jwk_from_jwks_uri/1\u003c/tt\u003e in \u003ctt\u003elib/boruta/adapters/ecto/clients.ex\u003c/tt\u003e later refreshes the stored \u003ctt\u003ejwks_uri\u003c/tt\u003e for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two \u003ctt\u003erequest_uri\u003c/tt\u003e clauses does not even restrict the scheme to \u003ctt\u003ehttp\u003c/tt\u003e or \u003ctt\u003ehttps\u003c/tt\u003e). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\u003c/p\u003e\u003cp\u003eThis issue affects boruta: from 2.3.2 before 2.3.7.\u003c/p\u003e"
}
],
"value": "Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints.\n\nThree code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |\u003e Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server\u0027s HTTP client at arbitrary network targets reachable from the Boruta host.\n\nThis issue affects boruta: from 2.3.2 before 2.3.7."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T04:20:03.434Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54885.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54885"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth \u003ctt\u003erequest_uri\u003c/tt\u003e dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed.\u003c/p\u003e"
}
],
"value": "Restrict the network egress of the Boruta host so that the OAuth/OpenID authorization server cannot reach loopback, private, link-local, multicast, or cloud metadata addresses. Where possible, disable application routes for OAuth request_uri dereferencing and OpenID Connect dynamic client registration, or restrict OpenID Connect dynamic client registration to trusted callers, until a patched release is deployed."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54885",
"datePublished": "2026-07-30T14:16:43.631Z",
"dateReserved": "2026-06-16T10:47:13.914Z",
"dateUpdated": "2026-07-31T04:20:03.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59247 (GCVE-0-2026-59247)
Vulnerability from cvelistv5 – Published: 2026-07-29 14:24 – Updated: 2026-07-30 04:15
VLAI
EPSS
VEX
Title
Insufficient verification of Hex package metadata in Gleam
Summary
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution.
During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release's dependency requirements and SHA-256 outer_checksum. After resolving versions, gleam_cli::dependencies::lookup_package makes a second request to the unsigned Hex API through gleam_core::hex::get_package_release and records the outer_checksum and dependency names from that JSON response into manifest.toml, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response.
An adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through GLEAM_CACERTS_PATH), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents.
Only projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good manifest.toml continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gleam-lang/gleam/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59247.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59247 | related |
| https://github.com/gleam-lang/gleam/commit/c9c0d4… | patch |
| https://github.com/hexpm/specifications/blob/main… | related |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| gleam-lang | gleam |
Affected:
0.18.0 , < 1.18.0
(semver)
cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* |
|
| gleam-lang | gleam |
Affected:
0.18.0 , < 1.18.0
(semver)
Affected: 8447b78cc844ff4aec44eea23dbd68d1fea11f11 , < c9c0d48c123c8abae6db8dd61b25ccb427ed3d35 (git) cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* |
|
| gleam-lang | gleam |
Affected:
v0.18.0-elixir , < v1.18.0-elixir
(other)
Affected: v0.18.0-elixir-slim , < v1.18.0-elixir-slim (other) Affected: v0.18.0-elixir-alpine , < v1.18.0-elixir-alpine (other) Affected: v0.18.0-erlang , < v1.18.0-erlang (other) Affected: v0.18.0-erlang-slim , < v1.18.0-erlang-slim (other) Affected: v0.18.0-erlang-alpine , < v1.18.0-erlang-alpine (other) Affected: v0.18.0-node , < v1.18.0-node (other) Affected: v0.18.0-node-slim , < v1.18.0-node-slim (other) Affected: v0.18.0-node-alpine , < v1.18.0-node-alpine (other) Affected: v1.6.0-scratch , < v1.18.0-scratch (other) cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T15:03:54.127187Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:09:39.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gleam.run",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"gleam_cli::dependencies",
"gleam_cli::dependencies::dependency_manager"
],
"packageName": "gleam.run/gleam",
"packageURL": "pkg:sid/gleam.run/gleam",
"product": "gleam",
"programFiles": [
"compiler-cli/src/dependencies.rs",
"compiler-cli/src/dependencies/dependency_manager.rs"
],
"programRoutines": [
{
"name": "gleam_cli::dependencies::lookup_package"
},
{
"name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
}
],
"repo": "https://github.com/gleam-lang/gleam",
"vendor": "gleam-lang",
"versions": [
{
"lessThan": "1.18.0",
"status": "affected",
"version": "0.18.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"gleam_cli::dependencies",
"gleam_cli::dependencies::dependency_manager"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:github/gleam-lang/gleam",
"product": "gleam",
"programFiles": [
"compiler-cli/src/dependencies.rs",
"compiler-cli/src/dependencies/dependency_manager.rs"
],
"programRoutines": [
{
"name": "gleam_cli::dependencies::lookup_package"
},
{
"name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
}
],
"repo": "https://github.com/gleam-lang/gleam",
"vendor": "gleam-lang",
"versions": [
{
"lessThan": "1.18.0",
"status": "affected",
"version": "0.18.0",
"versionType": "semver"
},
{
"lessThan": "c9c0d48c123c8abae6db8dd61b25ccb427ed3d35",
"status": "affected",
"version": "8447b78cc844ff4aec44eea23dbd68d1fea11f11",
"versionType": "git"
}
]
},
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"gleam_cli::dependencies",
"gleam_cli::dependencies::dependency_manager"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
"product": "gleam",
"programFiles": [
"compiler-cli/src/dependencies.rs",
"compiler-cli/src/dependencies/dependency_manager.rs"
],
"programRoutines": [
{
"name": "gleam_cli::dependencies::lookup_package"
},
{
"name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
}
],
"vendor": "gleam-lang",
"versions": [
{
"lessThan": "v1.18.0-elixir",
"status": "affected",
"version": "v0.18.0-elixir",
"versionType": "other"
},
{
"lessThan": "v1.18.0-elixir-slim",
"status": "affected",
"version": "v0.18.0-elixir-slim",
"versionType": "other"
},
{
"lessThan": "v1.18.0-elixir-alpine",
"status": "affected",
"version": "v0.18.0-elixir-alpine",
"versionType": "other"
},
{
"lessThan": "v1.18.0-erlang",
"status": "affected",
"version": "v0.18.0-erlang",
"versionType": "other"
},
{
"lessThan": "v1.18.0-erlang-slim",
"status": "affected",
"version": "v0.18.0-erlang-slim",
"versionType": "other"
},
{
"lessThan": "v1.18.0-erlang-alpine",
"status": "affected",
"version": "v0.18.0-erlang-alpine",
"versionType": "other"
},
{
"lessThan": "v1.18.0-node",
"status": "affected",
"version": "v0.18.0-node",
"versionType": "other"
},
{
"lessThan": "v1.18.0-node-slim",
"status": "affected",
"version": "v0.18.0-node-slim",
"versionType": "other"
},
{
"lessThan": "v1.18.0-node-alpine",
"status": "affected",
"version": "v0.18.0-node-alpine",
"versionType": "other"
},
{
"lessThan": "v1.18.0-scratch",
"status": "affected",
"version": "v1.6.0-scratch",
"versionType": "other"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.0",
"versionStartIncluding": "0.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "John Downey"
},
{
"lang": "en",
"type": "remediation developer",
"value": "John Downey"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Louis Pilfold"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution.\u003cp\u003eDuring dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release\u0027s dependency requirements and SHA-256 \u003ctt\u003eouter_checksum\u003c/tt\u003e. After resolving versions, \u003ctt\u003egleam_cli::dependencies::lookup_package\u003c/tt\u003e makes a second request to the unsigned Hex API through \u003ctt\u003egleam_core::hex::get_package_release\u003c/tt\u003e and records the \u003ctt\u003eouter_checksum\u003c/tt\u003e and dependency names from that JSON response into \u003ctt\u003emanifest.toml\u003c/tt\u003e, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response.\u003c/p\u003e\u003cp\u003eAn adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through \u003ctt\u003eGLEAM_CACERTS_PATH\u003c/tt\u003e), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents.\u003c/p\u003e\u003cp\u003eOnly projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good \u003ctt\u003emanifest.toml\u003c/tt\u003e continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0.\u003c/p\u003e"
}
],
"value": "Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution.\n\nDuring dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release\u0027s dependency requirements and SHA-256 outer_checksum. After resolving versions, gleam_cli::dependencies::lookup_package makes a second request to the unsigned Hex API through gleam_core::hex::get_package_release and records the outer_checksum and dependency names from that JSON response into manifest.toml, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response.\n\nAn adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through GLEAM_CACERTS_PATH), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents.\n\nOnly projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good manifest.toml continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
},
{
"capecId": "CAPEC-185",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-185 Malicious Software Download"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T04:15:30.182Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-4vvc-458m-r82g"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59247.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59247"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gleam-lang/gleam/commit/c9c0d48c123c8abae6db8dd61b25ccb427ed3d35"
},
{
"tags": [
"related"
],
"url": "https://github.com/hexpm/specifications/blob/main/registry-v2.md"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Insufficient verification of Hex package metadata in Gleam",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59247",
"datePublished": "2026-07-29T14:24:55.499Z",
"dateReserved": "2026-07-04T04:24:03.652Z",
"dateUpdated": "2026-07-30T04:15:30.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65624 (GCVE-0-2026-65624)
Vulnerability from cvelistv5 – Published: 2026-07-28 10:01 – Updated: 2026-07-29 04:17
VLAI
EPSS
VEX
Title
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.
The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (", " for regular headers, "; " for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process's binary memory to arbitrary size within the request window.
The impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions.
This issue affects cowboy from 2.0.0-pre.4 before 2.18.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-65624.html | relatedthird-party-advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-65624 | related |
| https://github.com/ninenines/cowboy/commit/3a34d8… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T12:38:53.899266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:39:27.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cowboy_http"
],
"packageName": "cowboy",
"packageURL": "pkg:hex/cowboy",
"product": "cowboy",
"programFiles": [
"src/cowboy_http.erl"
],
"programRoutines": [
{
"name": "cowboy_http:parse_header/3"
},
{
"name": "cowboy_http:parse_hd_value/6"
}
],
"repo": "https://github.com/ninenines/cowboy",
"vendor": "ninenines",
"versions": [
{
"lessThan": "2.18.0",
"status": "affected",
"version": "2.0.0-pre.4",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cowboy_http"
],
"packageName": "ninenines/cowboy",
"packageURL": "pkg:github/ninenines/cowboy",
"product": "cowboy",
"programFiles": [
"src/cowboy_http.erl"
],
"programRoutines": [
{
"name": "cowboy_http:parse_header/3"
},
{
"name": "cowboy_http:parse_hd_value/6"
}
],
"repo": "https://github.com/ninenines/cowboy",
"vendor": "ninenines",
"versions": [
{
"lessThan": "3a34d8c1cfd94326466aa16a9017236691dc9c55",
"status": "affected",
"version": "309780a9fda145c262a47ac7811ffd50a0271c5b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.18.0",
"versionStartIncluding": "2.0.0-pre.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qiyi Deng / Wuhan University"
},
{
"lang": "en",
"type": "finder",
"value": "Min Shi / Wuhan University"
},
{
"lang": "en",
"type": "finder",
"value": "Yongkang Xiao / Wuhan University"
},
{
"lang": "en",
"type": "finder",
"value": "Jing Chen / Wuhan University"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lo\u00efc Hoguin"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.\u003c/p\u003e\u003cp\u003eThe HTTP/1.1 handler in \u003ctt\u003ecowboy_http\u003c/tt\u003e enforces the \u003ctt\u003emax_headers\u003c/tt\u003e limit by counting the number of distinct header names in a map (\u003ctt\u003emaps:size(Headers)\u003c/tt\u003e). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (\u003ctt\u003e\", \"\u003c/tt\u003e for regular headers, \u003ctt\u003e\"; \"\u003c/tt\u003e for cookies), so the map size stays at one and the \u003ctt\u003emax_headers\u003c/tt\u003e cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line \u003ctt\u003emax_header_name_length\u003c/tt\u003e and \u003ctt\u003emax_header_value_length\u003c/tt\u003e apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process\u0027s binary memory to arbitrary size within the request window.\u003c/p\u003e\u003cp\u003eThe impact per connection is bounded by \u003ctt\u003erequest_timeout\u003c/tt\u003e (default 5 seconds, not reset by header data), and by \u003ctt\u003emax_heap_size\u003c/tt\u003e when set (the offending connection process is killed once its heap grows past the limit). When \u003ctt\u003emax_heap_size\u003c/tt\u003e is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions.\u003c/p\u003e\u003cp\u003eThis issue affects cowboy from 2.0.0-pre.4 before 2.18.0.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.\n\nThe HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (\", \" for regular headers, \"; \" for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process\u0027s binary memory to arbitrary size within the request window.\n\nThe impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions.\n\nThis issue affects cowboy from 2.0.0-pre.4 before 2.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T04:17:22.788Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65624.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65624"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ninenines/cowboy/commit/3a34d8c1cfd94326466aa16a9017236691dc9c55"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65624",
"datePublished": "2026-07-28T10:01:01.811Z",
"dateReserved": "2026-07-22T13:55:59.401Z",
"dateUpdated": "2026-07-29T04:17:22.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59248 (GCVE-0-2026-59248)
Vulnerability from cvelistv5 – Published: 2026-07-28 09:54 – Updated: 2026-07-29 04:18
VLAI
EPSS
VEX
Title
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Summary
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.
The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.
Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.
Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.
This issue affects cowlib: from 2.0.0 before 2.19.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-59248.html | third-party-advisoryrelated |
| https://osv.dev/vulnerability/EEF-CVE-2026-59248 | related |
| https://github.com/ninenines/cowlib/commit/f58243… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T12:39:48.662716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:40:53.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_hpack",
"cow_qpack"
],
"packageName": "cowlib",
"packageURL": "pkg:hex/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_hpack_common.hrl",
"src/cow_hpack.erl",
"src/cow_qpack.erl"
],
"programRoutines": [
{
"name": "cow_hpack:decode/2"
},
{
"name": "cow_qpack:decode_field_section/3"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"lessThan": "2.19.0",
"status": "affected",
"version": "2.0.0-pre.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_hpack",
"cow_qpack"
],
"packageName": "ninenines/cowlib",
"packageURL": "pkg:github/ninenines/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_hpack_common.hrl",
"src/cow_hpack.erl",
"src/cow_qpack.erl"
],
"programRoutines": [
{
"name": "cow_hpack:decode/2"
},
{
"name": "cow_qpack:decode_field_section/3"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"lessThan": "f582430498072a0c65ad338030321576dc13a343",
"status": "affected",
"version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.19.0",
"versionStartIncluding": "2.0.0-pre.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Hern\u00e1ndez"
},
{
"lang": "en",
"type": "reporter",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lo\u00efc Hoguin"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T04:18:17.483Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"third-party-advisory",
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59248",
"datePublished": "2026-07-28T09:54:19.579Z",
"dateReserved": "2026-07-04T04:24:03.652Z",
"dateUpdated": "2026-07-29T04:18:17.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54890 (GCVE-0-2026-54890)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:39 – Updated: 2026-07-28 09:55
VLAI
EPSS
VEX
Title
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
Summary
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.
The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".
The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).
Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).
This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54890.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54890 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/dc1bf9344c0c… | patch |
Impacted products
2 products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:18:57.223218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:19:08.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"erts"
],
"packageName": "erts",
"packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"emulator/beam/external.c"
],
"programRoutines": [
{
"name": "erlang:binary_to_term/1"
},
{
"name": "erlang:binary_to_term/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "15.2.7.11",
"status": "unaffected"
},
{
"at": "16.4.0.4",
"status": "unaffected"
},
{
"at": "17.0.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "15.0",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"erts"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"erts/emulator/beam/external.c"
],
"programRoutines": [
{
"name": "erlang:binary_to_term/1"
},
{
"name": "erlang:binary_to_term/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.15",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "29.0.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "27.0",
"versionType": "otp"
},
{
"lessThan": "dc1bf9344c0ce62717cf60866590cea0242780fd",
"status": "affected",
"version": "24ef4cbaeda9b9c26682cba75f2f15b0c58722aa",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"versionStartIncluding": "27.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Paul Guyot"
},
{
"lang": "en",
"type": "finder",
"value": "Lukas Backstr\u00f6m"
},
{
"lang": "en",
"type": "remediation developer",
"value": "John H\u00f6gberg"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files \u003ctt\u003eerts/emulator/beam/external.c\u003c/tt\u003e, \u003ctt\u003eemulator/beam/external.c\u003c/tt\u003e.\u003cp\u003eThe \u003ctt\u003eBIT_BINARY_EXT\u003c/tt\u003e tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \u003ctt\u003eCannot allocate 2305843009213693951 bytes of memory (of type \"binary\")\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by \u003ctt\u003etry\u003c/tt\u003e/\u003ctt\u003ecatch\u003c/tt\u003e, or by passing the \u003ctt\u003e[safe]\u003c/tt\u003e option to \u003ctt\u003ebinary_to_term/2\u003c/tt\u003e (which only restricts atom creation and does not perform structural validation of binary encodings).\u003c/p\u003e\u003cp\u003eAny application that decodes ETF from untrusted sources via \u003ctt\u003ebinary_to_term/1,2\u003c/tt\u003e or \u003ctt\u003eenif_binary_to_term()\u003c/tt\u003e is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 27.0 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.\u003c/p\u003e"
}
],
"value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
},
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:55:08.138Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54890.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54890"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDo not call \u003ctt\u003ebinary_to_term/1,2\u003c/tt\u003e or \u003ctt\u003eenif_binary_to_term()\u003c/tt\u003e on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.\u003c/p\u003e"
}
],
"value": "Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54890",
"datePublished": "2026-07-27T15:39:03.475Z",
"dateReserved": "2026-06-16T10:47:13.915Z",
"dateUpdated": "2026-07-28T09:55:08.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59251 (GCVE-0-2026-59251)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:30 – Updated: 2026-07-28 09:54
VLAI
EPSS
VEX
Title
Denial of service via exponential certificate policy tree growth in path validation
Summary
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.
During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).
This is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS.
This vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.
This issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59251.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59251 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/f8580fc11709… | patch |
| https://github.com/erlang/otp/commit/f04c6bba38de… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:31:50.981990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:32:09.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"pubkey_policy_tree"
],
"packageName": "public_key",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/pubkey_policy_tree.erl"
],
"programRoutines": [
{
"name": "pubkey_policy_tree:add_leaves/2"
},
{
"name": "pubkey_policy_tree:add_leaf_siblings/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "1.21.4",
"status": "unaffected"
},
{
"at": "1.20.3.4",
"status": "unaffected"
},
{
"at": "1.17.1.5",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "1.15",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"pubkey_policy_tree"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/public_key/src/pubkey_policy_tree.erl"
],
"programRoutines": [
{
"name": "pubkey_policy_tree:add_leaves/2"
},
{
"name": "pubkey_policy_tree:add_leaf_siblings/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "26.2",
"versionType": "otp"
},
{
"changes": [
{
"at": "f8580fc117098c08165f46c26fd0750c5cfb2a90",
"status": "unaffected"
},
{
"at": "f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "9d1dda7bad5a64b58c10a1554751689e94131a73",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"versionStartIncluding": "26.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lukas Backstr\u00f6m"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Witczak"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Micha\u0142 W\u0105sowski"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.\u003c/p\u003e\u003cp\u003eDuring RFC 5280 policy processing in \u003ctt\u003epublic_key:pkix_path_validation/3\u003c/tt\u003e, the certificate policy tree maintained by \u003ctt\u003epubkey_policy_tree\u003c/tt\u003e grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because \u003ctt\u003epubkey_policy_tree:add_leaves/2\u003c/tt\u003e and \u003ctt\u003epubkey_policy_tree:add_leaf_siblings/2\u003c/tt\u003e extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node\u0027s memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer\u0027s chain (the default for SSL/TLS clients and mutual-TLS servers).\u003c/p\u003e\u003cp\u003eThis is the same vulnerability class as OpenSSL\u0027s \u003ctt\u003eX509_verify_cert\u003c/tt\u003e policy tree DoS.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/public_key/src/pubkey_policy_tree.erl\u003c/tt\u003e and program routines \u003ctt\u003epubkey_policy_tree:add_leaves/2\u003c/tt\u003e and \u003ctt\u003epubkey_policy_tree:add_leaf_siblings/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 26.2 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.\n\nDuring RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node\u0027s memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer\u0027s chain (the default for SSL/TLS clients and mutual-TLS servers).\n\nThis is the same vulnerability class as OpenSSL\u0027s X509_verify_cert policy tree DoS.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.\n\nThis issue affects OTP from OTP 26.2 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:54:59.169Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59251.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59251"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Denial of service via exponential certificate policy tree growth in path validation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59251",
"datePublished": "2026-07-27T15:30:47.097Z",
"dateReserved": "2026-07-04T04:24:03.653Z",
"dateUpdated": "2026-07-28T09:54:59.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59250 (GCVE-0-2026-59250)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:25 – Updated: 2026-07-28 09:55
VLAI
EPSS
VEX
Title
Megaco flex scanner buffer overflow via oversized property parm name
Summary
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.
When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service.
The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.
This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.
This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59250.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59250 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/8704c8f550a1… | patch |
Impacted products
2 products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59250",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:33:04.735708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:33:14.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"megaco_flex_scanner",
"megaco_flex_scanner_drv"
],
"packageName": "megaco",
"packageURL": "pkg:otp/megaco?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/flex/megaco_flex_scanner_drv.flex.src"
],
"programRoutines": [
{
"name": "mfs_load_property_groups"
},
{
"name": "megaco_flex_scanner:scan/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "4.9.1",
"status": "unaffected"
},
{
"at": "4.8.3.1",
"status": "unaffected"
},
{
"at": "4.7.2.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "3.17.1",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"megaco_flex_scanner",
"megaco_flex_scanner_drv"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src"
],
"programRoutines": [
{
"name": "mfs_load_property_groups"
},
{
"name": "megaco_flex_scanner:scan/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "R13B03",
"versionType": "otp"
},
{
"lessThan": "8704c8f550a11ed5f825e3c011ecb03565b79c4f",
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe megaco text codec must be configured to use the flex scanner via the encoder option \u003ctt\u003e{scanner, flex}\u003c/tt\u003e (the documented high-performance configuration). Deployments using the default Erlang-based scanner are not affected.\u003c/p\u003e"
}
],
"value": "The megaco text codec must be configured to use the flex scanner via the encoder option {scanner, flex} (the documented high-performance configuration). Deployments using the default Erlang-based scanner are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Witczak"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Micael Karlberg"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eClassic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver\u0027s memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.\u003c/p\u003e\u003cp\u003eWhen tokenizing a Local/Remote descriptor, \u003ctt\u003emfs_load_property_groups\u003c/tt\u003e extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte \u003ctt\u003eerror_msg\u003c/tt\u003e field of the \u003ctt\u003eMfsErlDrvData\u003c/tt\u003e struct using an unchecked \u003ctt\u003esprintf\u003c/tt\u003e call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (\u003ctt\u003etext_buf\u003c/tt\u003e, \u003ctt\u003etext_ptr\u003c/tt\u003e, \u003ctt\u003eterm_spec\u003c/tt\u003e, \u003ctt\u003eterm_spec_size\u003c/tt\u003e, \u003ctt\u003eterm_spec_index\u003c/tt\u003e), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with \u003ctt\u003e_FORTIFY_SOURCE\u003c/tt\u003e the overflow is detected at runtime and terminates the process with \u003ctt\u003eSIGABRT\u003c/tt\u003e, resulting in denial of service.\u003c/p\u003e\u003cp\u003eThe overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with \u003ctt\u003e{scanner, flex}\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/megaco/src/flex/megaco_flex_scanner_drv.flex.src\u003c/tt\u003e and program routines \u003ctt\u003emfs_load_property_groups\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 17.0 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.\u003c/p\u003e"
}
],
"value": "Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver\u0027s memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.\n\nWhen tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service.\n\nThe overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.\n\nThis vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.\n\nThis issue affects OTP from OTP 17.0 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:55:21.416Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59250.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59250"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Megaco flex scanner buffer overflow via oversized property parm name",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSwitch the megaco text codec to the default Erlang-based scanner by removing \u003ctt\u003e{scanner, flex}\u003c/tt\u003e from the encoder configuration. The Erlang scanner is not affected by this C-level memory corruption, at the cost of reduced parsing throughput.\u003c/p\u003e"
}
],
"value": "Switch the megaco text codec to the default Erlang-based scanner by removing {scanner, flex} from the encoder configuration. The Erlang scanner is not affected by this C-level memory corruption, at the cost of reduced parsing throughput."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59250",
"datePublished": "2026-07-27T15:25:03.106Z",
"dateReserved": "2026-07-04T04:24:03.653Z",
"dateUpdated": "2026-07-28T09:55:21.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55953 (GCVE-0-2026-55953)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:21 – Updated: 2026-07-28 09:54
VLAI
EPSS
VEX
Title
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
Summary
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.
An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.
This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-757 - Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55953.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55953 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/064e23641461… | patch |
| https://github.com/erlang/otp/commit/0a82596d425a… | patch |
| https://github.com/erlang/otp/commit/e6ff938116b2… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55953",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:33:59.966358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:34:10.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tls_handshake",
"ssl_handshake",
"ssl"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/tls_handshake.erl",
"src/ssl_handshake.erl"
],
"programRoutines": [
{
"name": "tls_handshake:hello/5"
},
{
"name": "ssl_handshake:handle_server_hello_extensions/9"
},
{
"name": "ssl:connect/2"
},
{
"name": "ssl:connect/3"
},
{
"name": "ssl:connect/4"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "11.7.4",
"status": "unaffected"
},
{
"at": "11.6.0.4",
"status": "unaffected"
},
{
"at": "11.2.12.11",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "5.3.4",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"tls_handshake",
"ssl_handshake",
"ssl"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/tls_handshake.erl",
"lib/ssl/src/ssl_handshake.erl"
],
"programRoutines": [
{
"name": "tls_handshake:hello/5"
},
{
"name": "ssl_handshake:handle_server_hello_extensions/9"
},
{
"name": "ssl:connect/2"
},
{
"name": "ssl:connect/3"
},
{
"name": "ssl:connect/4"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"changes": [
{
"at": "064e236414614f9085cbbbd6eacf0e43c02d1b4b",
"status": "unaffected"
},
{
"at": "0a82596d425abe43dc2e0b3d74aa1557ef74051c",
"status": "unaffected"
},
{
"at": "e6ff938116b2872bccc478af7fefb56627285b77",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability only affects TLS clients using TLS 1.2 (or earlier) or DTLS. TLS 1.3 client connections perform the cipher suite membership check and are not affected. Servers are not affected. Exploitation additionally requires an on-path (adversary-in-the-middle) attacker between the client and the intended server.\u003c/p\u003e"
}
],
"value": "The vulnerability only affects TLS clients using TLS 1.2 (or earlier) or DTLS. TLS 1.3 client connections perform the cipher suite membership check and are not affected. Servers are not affected. Exploitation additionally requires an on-path (adversary-in-the-middle) attacker between the client and the intended server."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ingela Anderton Andin"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Witczak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Erlang/OTP \u003ctt\u003essl\u003c/tt\u003e TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in \u003ctt\u003eServerHello\u003c/tt\u003e was among the suites offered by the client in \u003ctt\u003eClientHello\u003c/tt\u003e. The client-side \u003ctt\u003etls_handshake:hello/5\u003c/tt\u003e handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to \u003ctt\u003essl_handshake:handle_server_hello_extensions/9\u003c/tt\u003e, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.\u003c/p\u003e\u003cp\u003eAn on-path attacker between the client and the intended server can respond with a \u003ctt\u003eServerHello\u003c/tt\u003e selecting an anonymous key exchange suite such as \u003ctt\u003eTLS_DH_anon_*\u003c/tt\u003e or \u003ctt\u003eTLS_ECDH_anon_*\u003c/tt\u003e that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire \u003ctt\u003everify_peer\u003c/tt\u003e and \u003ctt\u003ecacerts\u003c/tt\u003e configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and \u003ctt\u003essl:connect\u003c/tt\u003e returns \u003ctt\u003e{ok, Socket}\u003c/tt\u003e. All subsequent application traffic is readable and modifiable by the attacker.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 17.0 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11.\u003c/p\u003e"
}
],
"value": "The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.\n\nAn on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.\n\nThis issue affects OTP from OTP 17.0 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-757",
"description": "CWE-757 Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:54:51.092Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55953.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55953"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eRestrict client connections to TLS 1.3 only by setting \u003ctt\u003eversions\u003c/tt\u003e to \u003ctt\u003e[\u0027tlsv1.3\u0027]\u003c/tt\u003e in the client\u0027s \u003ctt\u003essl\u003c/tt\u003e options. The TLS 1.3 client path performs the required cipher suite membership check and is not affected.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Restrict client connections to TLS 1.3 only by setting versions to [\u0027tlsv1.3\u0027] in the client\u0027s ssl options. The TLS 1.3 client path performs the required cipher suite membership check and is not affected."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55953",
"datePublished": "2026-07-27T15:21:29.327Z",
"dateReserved": "2026-06-17T17:55:15.686Z",
"dateUpdated": "2026-07-28T09:54:51.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55737 (GCVE-0-2026-55737)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:13 – Updated: 2026-07-28 09:55
VLAI
EPSS
VEX
Title
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Summary
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.
When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.
This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55737.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55737 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/c5210b42a9d3… | patch |
Impacted products
2 products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:34:45.698069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:34:55.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"erlang",
"external"
],
"packageName": "erts",
"packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"emulator/beam/external.c"
],
"programRoutines": [
{
"name": "erlang:binary_to_term/1"
},
{
"name": "erlang:binary_to_term/2"
},
{
"name": "dec_term"
},
{
"name": "decoded_size"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "17.0.4",
"status": "unaffected"
},
{
"at": "16.4.0.4",
"status": "unaffected"
},
{
"at": "15.2.7.11",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "13.0",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"erlang",
"external"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"erts/emulator/beam/external.c"
],
"programRoutines": [
{
"name": "erlang:binary_to_term/1"
},
{
"name": "erlang:binary_to_term/2"
},
{
"name": "dec_term"
},
{
"name": "decoded_size"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "25.0",
"versionType": "otp"
},
{
"lessThan": "c5210b42a9d3d96f3d25601942ce8122be0f3761",
"status": "affected",
"version": "ebcbb97b4ec223464cac3d94375739a248ddef6e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"versionStartIncluding": "25.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nick Gunn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Kiko Fernandez-Reyes"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Sverker Eriksson"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSigned to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP \u003ctt\u003eerts\u003c/tt\u003e allows an attacker who can supply a crafted Erlang external term format (ETF) binary to \u003ctt\u003ebinary_to_term/1\u003c/tt\u003e to corrupt the BEAM heap pointer and crash the virtual machine.\u003c/p\u003e\u003cp\u003eWhen decoding a \u003ctt\u003eLARGE_TUPLE_EXT\u003c/tt\u003e term, the validation pass \u003ctt\u003edecoded_size()\u003c/tt\u003e in \u003ctt\u003eerts/emulator/beam/external.c\u003c/tt\u003e reads the 32-bit arity field as unsigned (\u003ctt\u003eget_uint32()\u003c/tt\u003e), while the decode pass \u003ctt\u003edec_term()\u003c/tt\u003e reads the same field as a signed 32-bit integer (\u003ctt\u003eget_int32()\u003c/tt\u003e) into an \u003ctt\u003eint\u003c/tt\u003e. An arity wire value of \u003ctt\u003e0x80000000\u003c/tt\u003e passes validation as 2147483648 but decodes as -2147483648, so the subsequent \u003ctt\u003ehp += n\u003c/tt\u003e moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit \u003ctt\u003eMAX_ARITYVAL\u003c/tt\u003e. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 25.0 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to \u003ctt\u003eerts\u003c/tt\u003e from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.\u003c/p\u003e"
}
],
"value": "Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.\n\nWhen decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\n\nThis issue affects OTP from OTP 25.0 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-195",
"description": "CWE-195 Signed to Unsigned Conversion Error",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:55:26.434Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55737.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55737"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/c5210b42a9d3d96f3d25601942ce8122be0f3761"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55737",
"datePublished": "2026-07-27T15:13:54.699Z",
"dateReserved": "2026-06-17T10:44:34.365Z",
"dateUpdated": "2026-07-28T09:55:26.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47078 (GCVE-0-2026-47078)
Vulnerability from cvelistv5 – Published: 2026-07-27 15:03 – Updated: 2026-07-28 09:53
VLAI
EPSS
VEX
Title
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Summary
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.
This vulnerability is associated with program file lib/stdlib/src/zip.erl.
This issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-47078.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-47078 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/8a933c9c7835… | patch |
Impacted products
2 products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:38:46.508080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:38:54.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"zip"
],
"packageName": "stdlib",
"packageURL": "pkg:otp/stdlib?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "8.0.3",
"status": "unaffected"
},
{
"at": "7.3.0.1",
"status": "unaffected"
},
{
"at": "6.2.2.4",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "6.1",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"zip"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/stdlib/src/zip.erl"
],
"programRoutines": [
{
"name": "zip:unzip/1"
},
{
"name": "zip:unzip/2"
},
{
"name": "zip:extract/1"
},
{
"name": "zip:extract/2"
},
{
"name": "zip:check_dir_level/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "27.1",
"versionType": "otp"
},
{
"lessThan": "8a933c9c7835b06776d31d17b79b7336627d887a",
"status": "affected",
"version": "8d537f51a4262d24f3395c4148323eaca9facbbd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"versionStartIncluding": "27.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonatan M\u00e4nnchen"
},
{
"lang": "en",
"type": "finder",
"value": "Zhang Delong"
},
{
"lang": "en",
"type": "remediation developer",
"value": "John H\u00f6gberg"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.\u003cp\u003e\u003ctt\u003ezip:unzip/1,2\u003c/tt\u003e and \u003ctt\u003ezip:extract/1,2\u003c/tt\u003e validate entry paths using \u003ctt\u003ezip:check_dir_level/2\u003c/tt\u003e, which tracks directory depth as a running integer counter: \u003ctt\u003e..\u003c/tt\u003e decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as \u003ctt\u003e../x/y\u003c/tt\u003e causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via \u003ctt\u003eadd_cwd\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/stdlib/src/zip.erl\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 27.1 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4.\u003c/p\u003e"
}
],
"value": "Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.\n\nzip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.\n\nThis vulnerability is associated with program file lib/stdlib/src/zip.erl.\n\nThis issue affects OTP from OTP 27.1 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to stdlib from 6.1 before 8.0.3, 7.3.0.1 and 6.2.2.4."
}
],
"impacts": [
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139 Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:53:55.522Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47078.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47078"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47078",
"datePublished": "2026-07-27T15:03:50.929Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-07-28T09:53:55.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42792 (GCVE-0-2026-42792)
Vulnerability from cvelistv5 – Published: 2026-07-27 14:58 – Updated: 2026-07-28 09:55
VLAI
EPSS
VEX
Title
epmd permanent DoS via EMFILE on accept(2) in erts
Summary
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.
The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.
On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.
This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-42792.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-42792 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/865d203e4a6a… | patch |
Impacted products
2 products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:25:58.879765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:26:08.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"epmd_srv"
],
"packageName": "erts",
"packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"epmd/src/epmd_srv.c"
],
"programRoutines": [
{
"name": "do_accept"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "17.0.4",
"status": "unaffected"
},
{
"at": "16.4.0.4",
"status": "unaffected"
},
{
"at": "15.2.7.11",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "6.0",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"epmd_srv"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"erts/epmd/src/epmd_srv.c"
],
"programRoutines": [
{
"name": "do_accept"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"lessThan": "865d203e4a6a8f44179eced9e1428f9259e4a3bb",
"status": "affected",
"version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Moore"
},
{
"lang": "en",
"type": "remediation developer",
"value": "John H\u00f6gberg"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP \u003ctt\u003eerts\u003c/tt\u003e (\u003ctt\u003eepmd\u003c/tt\u003e) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.\u003cp\u003eThe \u003ctt\u003edo_accept\u003c/tt\u003e function in \u003ctt\u003eerts/epmd/src/epmd_srv.c\u003c/tt\u003e calls \u003ctt\u003eepmd_cleanup_exit()\u003c/tt\u003e when \u003ctt\u003eaccept(2)\u003c/tt\u003e returns \u003ctt\u003eEMFILE\u003c/tt\u003e (per-process file descriptor limit reached) or \u003ctt\u003eENFILE\u003c/tt\u003e (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd\u0027s file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing \u003ctt\u003eaccept(2)\u003c/tt\u003e to return \u003ctt\u003eEMFILE\u003c/tt\u003e, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.\u003c/p\u003e\u003cp\u003eOn Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd\u0027s start-rate-limit, permanently failing both \u003ctt\u003eepmd.service\u003c/tt\u003e and \u003ctt\u003eepmd.socket\u003c/tt\u003e and requiring manual operator intervention to recover.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 17.0 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15.\u003c/p\u003e"
}
],
"value": "Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.\n\nThe do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd\u0027s file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.\n\nOn Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd\u0027s start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.\n\nThis issue affects OTP from OTP 17.0 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15."
}
],
"impacts": [
{
"capecId": "CAPEC-227",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-227 Sustained Client Engagement"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:55:23.932Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-42792.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42792"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "epmd permanent DoS via EMFILE on accept(2) in erts",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eRestrict epmd to loopback only by adding a systemd socket override: set \u003ctt\u003eListenStream=\u003c/tt\u003e (empty, to clear), then \u003ctt\u003eListenStream=127.0.0.1:4369\u003c/tt\u003e and \u003ctt\u003eListenStream=[::1]:4369\u003c/tt\u003e in \u003ctt\u003e/etc/systemd/system/epmd.socket.d/override.conf\u003c/tt\u003e.\u003c/li\u003e\u003cli\u003eOn systemd-managed systems, raise the file descriptor limit and configure automatic restart by adding \u003ctt\u003eLimitNOFILE=65536\u003c/tt\u003e and \u003ctt\u003eRestart=always\u003c/tt\u003e with a suitable \u003ctt\u003eRestartSec\u003c/tt\u003e in \u003ctt\u003e/etc/systemd/system/epmd.service.d/override.conf\u003c/tt\u003e.\u003c/li\u003e\u003cli\u003eRestrict network access to TCP port 4369 via firewall rules to trusted hosts only.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Restrict epmd to loopback only by adding a systemd socket override: set ListenStream= (empty, to clear), then ListenStream=127.0.0.1:4369 and ListenStream=[::1]:4369 in /etc/systemd/system/epmd.socket.d/override.conf.\n* On systemd-managed systems, raise the file descriptor limit and configure automatic restart by adding LimitNOFILE=65536 and Restart=always with a suitable RestartSec in /etc/systemd/system/epmd.service.d/override.conf.\n* Restrict network access to TCP port 4369 via firewall rules to trusted hosts only."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-42792",
"datePublished": "2026-07-27T14:58:24.426Z",
"dateReserved": "2026-04-29T18:06:33.251Z",
"dateUpdated": "2026-07-28T09:55:23.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58227 (GCVE-0-2026-58227)
Vulnerability from cvelistv5 – Published: 2026-07-27 14:39 – Updated: 2026-07-28 09:53
VLAI
EPSS
VEX
Title
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Summary
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.
An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.
This issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-58227.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-58227 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/0307bff2c72b… | patch |
| https://github.com/erlang/otp/commit/241d43703989… | patch |
| https://github.com/erlang/otp/commit/7db647201779… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:25:16.012380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:25:26.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_certificate"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssl_certificate.erl"
],
"programRoutines": [
{
"name": "ssl_certificate:handle_incomplete_chain/5"
},
{
"name": "ssl_certificate:build_certificate_chain/5"
},
{
"name": "ssl_certificate:do_certificate_chain/7"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "11.7.4",
"status": "unaffected"
},
{
"at": "11.6.0.4",
"status": "unaffected"
},
{
"at": "11.2.12.11",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "10.2",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_certificate"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_certificate.erl"
],
"programRoutines": [
{
"name": "ssl_certificate:handle_incomplete_chain/5"
},
{
"name": "ssl_certificate:build_certificate_chain/5"
},
{
"name": "ssl_certificate:do_certificate_chain/7"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.4",
"status": "unaffected"
},
{
"at": "28.5.0.4",
"status": "unaffected"
},
{
"at": "27.3.4.15",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "23.2",
"versionType": "otp"
},
{
"changes": [
{
"at": "7db64720177961e04545681480d691c4be81c54d",
"status": "unaffected"
},
{
"at": "241d43703989fec4b6bf637beaeb366d92dcc4c2",
"status": "unaffected"
},
{
"at": "0307bff2c72b685c6bd952daaac6bd661c247d62",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "addc42df113f8f15fc20e9dff45490b3ce0d3d6b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.15",
"versionStartIncluding": "23.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.4",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.4",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lukas Backstr\u00f6m"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ingela Anderton Andin"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Dan Gudmundsson"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Witczak"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "John H\u00f6gberg"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Erlang/OTP \u003ctt\u003essl\u003c/tt\u003e application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In \u003ctt\u003essl_certificate:handle_incomplete_chain/5\u003c/tt\u003e, the received chain is passed to \u003ctt\u003essl_certificate:build_certificate_chain/5\u003c/tt\u003e, which walks issuer relationships via \u003ctt\u003essl_certificate:do_certificate_chain/7\u003c/tt\u003e with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.\u003c/p\u003e\u003cp\u003eAn unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS \u003ctt\u003eCertificate\u003c/tt\u003e handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 23.2 before OTP\u0026nbsp;29.0.4, OTP\u0026nbsp;28.5.0.4 and OTP\u0026nbsp;27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.\u003c/p\u003e"
}
],
"value": "The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound.\n\nAn unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages.\n\nThis issue affects OTP from OTP 23.2 before OTP\u00a029.0.4, OTP\u00a028.5.0.4 and OTP\u00a027.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T09:53:23.614Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-58227.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-58227"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/0307bff2c72b685c6bd952daaac6bd661c247d62"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-58227",
"datePublished": "2026-07-27T14:39:44.609Z",
"dateReserved": "2026-06-29T18:54:08.633Z",
"dateUpdated": "2026-07-28T09:53:23.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65623 (GCVE-0-2026-65623)
Vulnerability from cvelistv5 – Published: 2026-07-24 16:32 – Updated: 2026-07-25 04:16
VLAI
EPSS
VEX
Title
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
Summary
Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.
The size guard 'Elixir.Bandit.WebSocket.Connection':oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.
The max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.
This issue affects bandit: from 1.11.0 before 1.12.1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mtrudel/bandit/security/adviso… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-65623.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-65623 | related |
| https://github.com/mtrudel/bandit/commit/418ef7e9… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65623",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T17:08:51.111665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T17:09:09.552Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Bandit.WebSocket.Connection"
],
"packageName": "bandit",
"packageURL": "pkg:hex/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/websocket/connection.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.WebSocket.Connection\u0027:handle_frame/3"
},
{
"name": "\u0027Elixir.Bandit.WebSocket.Connection\u0027:oversize_message?/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "1.12.1",
"status": "affected",
"version": "1.11.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.Bandit.WebSocket.Connection"
],
"packageName": "mtrudel/bandit",
"packageURL": "pkg:github/mtrudel/bandit",
"product": "bandit",
"programFiles": [
"lib/bandit/websocket/connection.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Bandit.WebSocket.Connection\u0027:handle_frame/3"
},
{
"name": "\u0027Elixir.Bandit.WebSocket.Connection\u0027:oversize_message?/2"
}
],
"repo": "https://github.com/mtrudel/bandit",
"vendor": "mtrudel",
"versions": [
{
"lessThan": "418ef7e906192a230ddba112f7a669c87b6b0e3a",
"status": "affected",
"version": "21612c7c7b1ce43eccd36d3af3a2299d23513667",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis vulnerability only affects applications that serve WebSocket endpoints through Bandit (including Phoenix applications that use Bandit as the HTTP adapter). Applications that do not upgrade any connections to WebSocket are not affected.\u003c/p\u003e"
}
],
"value": "This vulnerability only affects applications that serve WebSocket endpoints through Bandit (including Phoenix applications that use Bandit as the HTTP adapter). Applications that do not upgrade any connections to WebSocket are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.12.1",
"versionStartIncluding": "1.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mat Trudel"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.\u003cp\u003eThe size guard \u003ctt\u003e\u0027Elixir.Bandit.WebSocket.Connection\u0027:oversize_message?/2\u003c/tt\u003e called from \u003ctt\u003ehandle_frame/3\u003c/tt\u003e in \u003ctt\u003elib/bandit/websocket/connection.ex\u003c/tt\u003e appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with \u003ctt\u003eIO.iodata_length/1\u003c/tt\u003e on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003emax_fragmented_message_size\u003c/tt\u003e limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.\u003c/p\u003e\u003cp\u003eThis issue affects bandit: from 1.11.0 before 1.12.1.\u003c/p\u003e"
}
],
"value": "Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.\n\nThe size guard \u0027Elixir.Bandit.WebSocket.Connection\u0027:oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.\n\nThe max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.\n\nThis issue affects bandit: from 1.11.0 before 1.12.1."
}
],
"impacts": [
{
"capecId": "CAPEC-229",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-229 Serialized Data Parameter Blowup"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-25T04:16:42.726Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65623.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65623"
},
{
"tags": [
"patch"
],
"url": "https://github.com/mtrudel/bandit/commit/418ef7e906192a230ddba112f7a669c87b6b0e3a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65623",
"datePublished": "2026-07-24T16:32:24.923Z",
"dateReserved": "2026-07-22T13:55:59.401Z",
"dateUpdated": "2026-07-25T04:16:42.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59252 (GCVE-0-2026-59252)
Vulnerability from cvelistv5 – Published: 2026-07-17 10:11 – Updated: 2026-07-18 04:12
VLAI
EPSS
VEX
Title
Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.
When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.
The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions.
This issue affects mpp: from 0.2.0 before 0.6.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZenHive/mpp/security/advisorie… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59252.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59252 | related |
| https://github.com/ZenHive/mpp/commit/d84e3e528db… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59252",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T12:21:12.801804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T12:21:18.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Methods.Tempo\u0027"
],
"packageName": "mpp",
"packageURL": "pkg:hex/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/methods/tempo.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Methods.Tempo\u0027:broadcast_and_verify/7"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "0.6.0",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Methods.Tempo\u0027"
],
"packageName": "ZenHive/mpp",
"packageURL": "pkg:github/ZenHive/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/methods/tempo.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Methods.Tempo\u0027:broadcast_and_verify/7"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "d84e3e528db39654540c2035ea0fbdf7b950d3d1",
"status": "affected",
"version": "d29d54e507918db00a5b65d90136b73166c017d7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerable code path is only reachable when the \u003ctt\u003eMPP.Methods.Tempo\u003c/tt\u003e method is configured with \u003ctt\u003efee_payer: true\u003c/tt\u003e (server-side gas sponsorship). Default deployments with \u003ctt\u003efee_payer: false\u003c/tt\u003e are not affected, since the client pays for gas out of its own wallet.\u003c/p\u003e"
}
],
"value": "The vulnerable code path is only reachable when the MPP.Methods.Tempo method is configured with fee_payer: true (server-side gas sponsorship). Default deployments with fee_payer: false are not affected, since the client pays for gas out of its own wallet."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.0",
"versionStartIncluding": "0.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kian Kai Ang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "E.FU"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.\u003c/p\u003e\u003cp\u003eWhen the \u003ctt\u003empp\u003c/tt\u003e Elixir library is configured as fee payer (\u003ctt\u003efee_payer: true\u003c/tt\u003e), the \u003ctt\u003eMPP.Methods.Tempo\u003c/tt\u003e payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied \u003ctt\u003egas_limit\u003c/tt\u003e is sufficient to complete the intended call. A malicious client can submit a signed \u003ctt\u003etransferWithMemo\u003c/tt\u003e transaction with \u003ctt\u003egas_limit\u003c/tt\u003e deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via \u003ctt\u003erpc_broadcast_sync\u003c/tt\u003e. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ewait_for_confirmation = false\u003c/tt\u003e (optimistic) path is also affected: it invokes \u003ctt\u003esimulate_payment_call\u003c/tt\u003e via \u003ctt\u003eeth_call\u003c/tt\u003e, but that simulation omits the \u003ctt\u003egas\u003c/tt\u003e parameter and therefore does not catch out-of-gas conditions.\u003c/p\u003e\u003cp\u003eThis issue affects mpp: from 0.2.0 before 0.6.0.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.\n\nWhen the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.\n\nThe wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions.\n\nThis issue affects mpp: from 0.2.0 before 0.6.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T04:12:42.459Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59252.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59252"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZenHive/mpp/commit/d84e3e528db39654540c2035ea0fbdf7b950d3d1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59252",
"datePublished": "2026-07-17T10:11:54.436Z",
"dateReserved": "2026-07-04T04:24:03.653Z",
"dateUpdated": "2026-07-18T04:12:42.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59694 (GCVE-0-2026-59694)
Vulnerability from cvelistv5 – Published: 2026-07-17 10:11 – Updated: 2026-07-18 04:12
VLAI
EPSS
VEX
Title
Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin.
When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including the EIP-2930 access list, without validating its length or contents. EIP-2930 access list entries incur intrinsic gas (~2,400 gas per address, plus 1,900 gas per storage key) charged before any opcode executes, regardless of whether the listed addresses are ever touched. A malicious client submits a valid transferWithMemo call alongside a large number of fabricated access-list entries. The server co-signs and broadcasts the transaction. The intended transfer executes normally, but the fee-payer wallet pays a large multiple of the expected gas cost with no corresponding on-chain work.
At the maintainer's default of 137 access-list entries (fitting within Bandit's 10,000-byte per-header-field limit) and 100 Gwei max_fee_per_gas, per-payment gas cost rises from ~51,287 to ~380,087 gas, a 7.4x multiplier. Sustained abuse destroys the sponsor's operating margin on low-cost payments and, over time, drains the fee-payer wallet.
This issue affects mpp: from 0.2.0 before 0.6.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZenHive/mpp/security/advisorie… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59694.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59694 | related |
| https://github.com/ZenHive/mpp/commit/5d6338e2334… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59694",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T12:22:40.105353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T12:22:45.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-qpxh-ff8m-c62v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Tempo.Transaction\u0027"
],
"packageName": "mpp",
"packageURL": "pkg:hex/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/tempo/transaction.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Tempo.Transaction\u0027:cosign_fee_payer/3"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "0.6.0",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Tempo.Transaction\u0027"
],
"packageName": "ZenHive/mpp",
"packageURL": "pkg:github/ZenHive/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/tempo/transaction.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Tempo.Transaction\u0027:cosign_fee_payer/3"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "5d6338e2334084c5f2a78cfcca474830733ed7e8",
"status": "affected",
"version": "d29d54e507918db00a5b65d90136b73166c017d7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerable code path is only reachable when the \u003ctt\u003eMPP.Methods.Tempo\u003c/tt\u003e method is configured with \u003ctt\u003efee_payer: true\u003c/tt\u003e (server-side gas sponsorship). Default deployments with \u003ctt\u003efee_payer: false\u003c/tt\u003e are not affected, since the client pays for gas out of its own wallet.\u003c/p\u003e"
}
],
"value": "The vulnerable code path is only reachable when the MPP.Methods.Tempo method is configured with fee_payer: true (server-side gas sponsorship). Default deployments with fee_payer: false are not affected, since the client pays for gas out of its own wallet."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.0",
"versionStartIncluding": "0.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kian Kai Ang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "E.FU"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer\u0027s gas cost per payment by a large multiplier, degrading the sponsor\u0027s operating margin.\u003c/p\u003e\u003cp\u003eWhen the \u003ctt\u003empp\u003c/tt\u003e Elixir library is configured as fee payer (\u003ctt\u003efee_payer: true\u003c/tt\u003e), \u003ctt\u003eMPP.Tempo.Transaction.cosign_fee_payer/3\u003c/tt\u003e re-signs the client-supplied base fields of the \u003ctt\u003e0x76\u003c/tt\u003e AASigned envelope verbatim, including the EIP-2930 access list, without validating its length or contents. EIP-2930 access list entries incur intrinsic gas (~2,400 gas per address, plus 1,900 gas per storage key) charged before any opcode executes, regardless of whether the listed addresses are ever touched. A malicious client submits a valid \u003ctt\u003etransferWithMemo\u003c/tt\u003e call alongside a large number of fabricated access-list entries. The server co-signs and broadcasts the transaction. The intended transfer executes normally, but the fee-payer wallet pays a large multiple of the expected gas cost with no corresponding on-chain work.\u003c/p\u003e\u003cp\u003eAt the maintainer\u0027s default of 137 access-list entries (fitting within Bandit\u0027s 10,000-byte per-header-field limit) and 100 Gwei \u003ctt\u003emax_fee_per_gas\u003c/tt\u003e, per-payment gas cost rises from ~51,287 to ~380,087 gas, a 7.4x multiplier. Sustained abuse destroys the sponsor\u0027s operating margin on low-cost payments and, over time, drains the fee-payer wallet.\u003c/p\u003e\u003cp\u003eThis issue affects mpp: from 0.2.0 before 0.6.0.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer\u0027s gas cost per payment by a large multiplier, degrading the sponsor\u0027s operating margin.\n\nWhen the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including the EIP-2930 access list, without validating its length or contents. EIP-2930 access list entries incur intrinsic gas (~2,400 gas per address, plus 1,900 gas per storage key) charged before any opcode executes, regardless of whether the listed addresses are ever touched. A malicious client submits a valid transferWithMemo call alongside a large number of fabricated access-list entries. The server co-signs and broadcasts the transaction. The intended transfer executes normally, but the fee-payer wallet pays a large multiple of the expected gas cost with no corresponding on-chain work.\n\nAt the maintainer\u0027s default of 137 access-list entries (fitting within Bandit\u0027s 10,000-byte per-header-field limit) and 100 Gwei max_fee_per_gas, per-payment gas cost rises from ~51,287 to ~380,087 gas, a 7.4x multiplier. Sustained abuse destroys the sponsor\u0027s operating margin on low-cost payments and, over time, drains the fee-payer wallet.\n\nThis issue affects mpp: from 0.2.0 before 0.6.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T04:12:36.335Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-qpxh-ff8m-c62v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59694.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59694"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59694",
"datePublished": "2026-07-17T10:11:49.192Z",
"dateReserved": "2026-07-06T14:05:47.003Z",
"dateUpdated": "2026-07-18T04:12:36.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59695 (GCVE-0-2026-59695)
Vulnerability from cvelistv5 – Published: 2026-07-17 10:11 – Updated: 2026-07-18 04:12
VLAI
EPSS
VEX
Title
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.
When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.
This issue affects mpp: from 0.2.0 before 0.6.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ZenHive/mpp/security/advisorie… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59695.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59695 | related |
| https://github.com/ZenHive/mpp/commit/5d6338e2334… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59695",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T12:53:10.647332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T12:53:17.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vv77-66rf-pm86"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Tempo.Transaction\u0027"
],
"packageName": "mpp",
"packageURL": "pkg:hex/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/tempo/transaction.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Tempo.Transaction\u0027:cosign_fee_payer/3"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "0.6.0",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.MPP.Tempo.Transaction\u0027"
],
"packageName": "ZenHive/mpp",
"packageURL": "pkg:github/ZenHive/mpp",
"product": "mpp",
"programFiles": [
"lib/mpp/tempo/transaction.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.MPP.Tempo.Transaction\u0027:cosign_fee_payer/3"
}
],
"repo": "https://github.com/ZenHive/mpp",
"vendor": "ZenHive",
"versions": [
{
"lessThan": "5d6338e2334084c5f2a78cfcca474830733ed7e8",
"status": "affected",
"version": "d29d54e507918db00a5b65d90136b73166c017d7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerable code path is only reachable when the \u003ctt\u003eMPP.Methods.Tempo\u003c/tt\u003e method is configured with \u003ctt\u003efee_payer: true\u003c/tt\u003e (server-side gas sponsorship). Default deployments with \u003ctt\u003efee_payer: false\u003c/tt\u003e are not affected, since the client pays for gas out of its own wallet.\u003c/p\u003e"
}
],
"value": "The vulnerable code path is only reachable when the MPP.Methods.Tempo method is configured with fee_payer: true (server-side gas sponsorship). Default deployments with fee_payer: false are not affected, since the client pays for gas out of its own wallet."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.0",
"versionStartIncluding": "0.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "AND"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kian Kai Ang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "E.FU"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.\u003c/p\u003e\u003cp\u003eWhen the \u003ctt\u003empp\u003c/tt\u003e Elixir library is configured as fee payer (\u003ctt\u003efee_payer: true\u003c/tt\u003e), \u003ctt\u003eMPP.Tempo.Transaction.cosign_fee_payer/3\u003c/tt\u003e re-signs the client-supplied base fields of the \u003ctt\u003e0x76\u003c/tt\u003e AASigned envelope verbatim, including \u003ctt\u003emax_fee_per_gas\u003c/tt\u003e and \u003ctt\u003emax_priority_fee_per_gas\u003c/tt\u003e, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The \u003ctt\u003eeffective_gas_price\u003c/tt\u003e billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.\u003c/p\u003e\u003cp\u003eThis issue affects mpp: from 0.2.0 before 0.6.0.\u003c/p\u003e"
}
],
"value": "Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.\n\nWhen the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.\n\nThis issue affects mpp: from 0.2.0 before 0.6.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T04:12:26.916Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vv77-66rf-pm86"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59695.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59695"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59695",
"datePublished": "2026-07-17T10:11:43.674Z",
"dateReserved": "2026-07-06T14:05:47.003Z",
"dateUpdated": "2026-07-18T04:12:26.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59249 (GCVE-0-2026-59249)
Vulnerability from cvelistv5 – Published: 2026-07-16 11:39 – Updated: 2026-07-17 10:11
VLAI
EPSS
VEX
Title
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
Summary
Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.
The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early.
An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.
This issue affects mint: from 0.1.0 before 1.9.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-mint/mint/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59249.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59249 | related |
| https://github.com/elixir-mint/mint/commit/fc7d16… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-mint | mint |
Affected:
0.1.0 , < 1.9.3
(semver)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
|
| elixir-mint | mint |
Affected:
60089586ec7adc9fddb09f69a2f5919ba9ac7f33 , < fc7d16538db7e40b56ed489f08683225cb0197fa
(git)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59249",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T12:37:52.637521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T12:38:16.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "mint",
"packageURL": "pkg:hex/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "1.9.3",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "elixir-mint/mint",
"packageURL": "pkg:github/elixir-mint/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "fc7d16538db7e40b56ed489f08683225cb0197fa",
"status": "affected",
"version": "60089586ec7adc9fddb09f69a2f5919ba9ac7f33",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present.\u003c/p\u003e"
}
],
"value": "Exploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.3",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thepigtails"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrea Leopardi"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eMint.HTTP1.decode_body/5\u003c/tt\u003e function in \u003ctt\u003elib/mint/http1.ex\u003c/tt\u003e parses the chunk-size line of a \u003ctt\u003eTransfer-Encoding: chunked\u003c/tt\u003e response with \u003ctt\u003eInteger.parse(data, 16)\u003c/tt\u003e. RFC 7230 defines \u003ctt\u003echunk-size = 1*HEXDIG\u003c/tt\u003e and forbids any sign prefix, but \u003ctt\u003eInteger.parse/2\u003c/tt\u003e accepts an optional leading \u003ctt\u003e+\u003c/tt\u003e or \u003ctt\u003e-\u003c/tt\u003e. A chunk-size line of \u003ctt\u003e+5\u003c/tt\u003e is accepted as a five-byte chunk; lines of \u003ctt\u003e+0\u003c/tt\u003e and \u003ctt\u003e-0\u003c/tt\u003e are accepted as the terminating zero-length chunk and end the message body early.\u003c/p\u003e\u003cp\u003eAn RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.1.0 before 1.9.3.\u003c/p\u003e"
}
],
"value": "Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.\n\nThe Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early.\n\nAn RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.\n\nThis issue affects mint: from 0.1.0 before 1.9.3."
}
],
"impacts": [
{
"capecId": "CAPEC-273",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-273 HTTP Response Smuggling"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T10:11:36.783Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59249.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59249"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-mint/mint/commit/fc7d16538db7e40b56ed489f08683225cb0197fa"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59249",
"datePublished": "2026-07-16T11:39:29.939Z",
"dateReserved": "2026-07-04T04:24:03.652Z",
"dateUpdated": "2026-07-17T10:11:36.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55954 (GCVE-0-2026-55954)
Vulnerability from cvelistv5 – Published: 2026-07-14 15:08 – Updated: 2026-07-15 04:14
VLAI
EPSS
VEX
Title
Missing ID token claim validation in ueberauth_apple allows account takeover
Summary
Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.
The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple's JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handle_callback!/1, which derives the logged-in user's uid and email directly from the unvalidated sub claim.
An attacker who obtains any Apple-signed ID token bearing the victim's sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team.
This issue affects ueberauth_apple: from 0.1.0 before 0.6.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/ueberauth_apple/secu… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55954.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55954 | related |
| https://github.com/ueberauth/ueberauth_apple/comm… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ueberauth | ueberauth_apple |
Affected:
0.1.0 , < 0.6.2
(semver)
cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:* |
|
| ueberauth | ueberauth_apple |
Affected:
3908a187d045c75994b62ce340c3aa26bb8976b8 , < 01e2d9c9b3134e1b78633ad82d136d5ff4a61f28
(git)
cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55954",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T15:56:35.178814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:56:51.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ueberauth/ueberauth_apple/security/advisories/GHSA-pxx8-68pc-p9mr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ueberauth.Strategy.Apple\u0027",
"\u0027Elixir.Ueberauth.Strategy.Apple.Token\u0027"
],
"packageName": "ueberauth_apple",
"packageURL": "pkg:hex/ueberauth_apple",
"product": "ueberauth_apple",
"programFiles": [
"lib/ueberauth/strategy/apple.ex",
"lib/ueberauth/strategy/apple/token.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ueberauth.Strategy.Apple\u0027:handle_callback!/1"
},
{
"name": "\u0027Elixir.Ueberauth.Strategy.Apple.Token\u0027:payload/2"
}
],
"repo": "https://github.com/ueberauth/ueberauth_apple",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "0.6.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ueberauth.Strategy.Apple\u0027",
"\u0027Elixir.Ueberauth.Strategy.Apple.Token\u0027"
],
"packageName": "ueberauth/ueberauth_apple",
"packageURL": "pkg:github/ueberauth/ueberauth_apple",
"product": "ueberauth_apple",
"programFiles": [
"lib/ueberauth/strategy/apple.ex",
"lib/ueberauth/strategy/apple/token.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ueberauth.Strategy.Apple\u0027:handle_callback!/1"
},
{
"name": "\u0027Elixir.Ueberauth.Strategy.Apple.Token\u0027:payload/2"
}
],
"repo": "https://github.com/ueberauth/ueberauth_apple",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "01e2d9c9b3134e1b78633ad82d136d5ff4a61f28",
"status": "affected",
"version": "3908a187d045c75994b62ce340c3aa26bb8976b8",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:ueberauth_apple:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.6.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xRenSec"
},
{
"lang": "en",
"type": "remediation developer",
"value": "AJ Foster"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.\u003cp\u003eThe \u003ctt\u003eUeberauth.Strategy.Apple.Token.payload/2\u003c/tt\u003e function verifies the JWT signature of the callback \u003ctt\u003eid_token\u003c/tt\u003e against Apple\u0027s JWKS but does not validate any registered claims. The \u003ctt\u003eiss\u003c/tt\u003e, \u003ctt\u003eaud\u003c/tt\u003e, \u003ctt\u003eexp\u003c/tt\u003e, and \u003ctt\u003eiat\u003c/tt\u003e claims are read from the token and passed on to \u003ctt\u003eUeberauth.Strategy.Apple.handle_callback!/1\u003c/tt\u003e, which derives the logged-in user\u0027s \u003ctt\u003euid\u003c/tt\u003e and \u003ctt\u003eemail\u003c/tt\u003e directly from the unvalidated \u003ctt\u003esub\u003c/tt\u003e claim.\u003c/p\u003e\u003cp\u003eAn attacker who obtains any Apple-signed ID token bearing the victim\u0027s \u003ctt\u003esub\u003c/tt\u003e (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent \u003ctt\u003eexp\u003c/tt\u003e check makes stolen tokens usable indefinitely, and the absent \u003ctt\u003eaud\u003c/tt\u003e check enables cross-application account takeover across clients that share an Apple developer team.\u003c/p\u003e\u003cp\u003eThis issue affects ueberauth_apple: from 0.1.0 before 0.6.2.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims.\n\nThe Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_token against Apple\u0027s JWKS but does not validate any registered claims. The iss, aud, exp, and iat claims are read from the token and passed on to Ueberauth.Strategy.Apple.handle_callback!/1, which derives the logged-in user\u0027s uid and email directly from the unvalidated sub claim.\n\nAn attacker who obtains any Apple-signed ID token bearing the victim\u0027s sub (via a captured expired token, or via an ID token issued to a sibling client in the same Apple developer team) can replay it against the vulnerable callback and be authenticated as the victim. The absent exp check makes stolen tokens usable indefinitely, and the absent aud check enables cross-application account takeover across clients that share an Apple developer team.\n\nThis issue affects ueberauth_apple: from 0.1.0 before 0.6.2."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T04:14:10.603Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/ueberauth_apple/security/advisories/GHSA-pxx8-68pc-p9mr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55954.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55954"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/ueberauth_apple/commit/01e2d9c9b3134e1b78633ad82d136d5ff4a61f28"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing ID token claim validation in ueberauth_apple allows account takeover",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55954",
"datePublished": "2026-07-14T15:08:26.051Z",
"dateReserved": "2026-06-17T17:55:15.686Z",
"dateUpdated": "2026-07-15T04:14:10.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59246 (GCVE-0-2026-59246)
Vulnerability from cvelistv5 – Published: 2026-07-14 08:37 – Updated: 2026-07-14 15:08
VLAI
EPSS
VEX
Title
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
Summary
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.
The Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper.
A malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.
This issue affects mint: from 0.1.0 before 1.9.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-mint/mint/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-59246.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-59246 | related |
| https://github.com/elixir-mint/mint/commit/5779de… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-mint | mint |
Affected:
0.1.0 , < 1.9.2
(semver)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
|
| elixir-mint | mint |
Affected:
596ca4304504be68939c4929e0831557097962b8 , < 5779de1666344b32aefc4354184ea07f902f73ce
(git)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59246",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T12:25:59.949476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:26:05.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP2\u0027"
],
"packageName": "mint",
"packageURL": "pkg:hex/mint",
"product": "mint",
"programFiles": [
"lib/mint/http2.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP2\u0027:handle_continuation/3"
},
{
"name": "\u0027Elixir.Mint.HTTP2\u0027:assert_header_block_within_max_size/2"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "1.9.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP2\u0027"
],
"packageName": "elixir-mint/mint",
"packageURL": "pkg:github/elixir-mint/mint",
"product": "mint",
"programFiles": [
"lib/mint/http2.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP2\u0027:handle_continuation/3"
},
{
"name": "\u0027Elixir.Mint.HTTP2\u0027:assert_header_block_within_max_size/2"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "5779de1666344b32aefc4354184ea07f902f73ce",
"status": "affected",
"version": "596ca4304504be68939c4929e0831557097962b8",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx (Jace)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrea Leopardi"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eMint.HTTP2.handle_continuation/3\u003c/tt\u003e function in \u003ctt\u003elib/mint/http2.ex\u003c/tt\u003e accumulates the header-block fragment carried by each HTTP/2 \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame into a growing \u003ctt\u003econn.headers_being_processed\u003c/tt\u003e nesting, one level deeper per frame, and only releases it when a frame with the \u003ctt\u003eEND_HEADERS\u003c/tt\u003e flag arrives. The only guard on this accumulator is \u003ctt\u003eMint.HTTP2.assert_header_block_within_max_size/2\u003c/tt\u003e, which sums the byte size of the fragments received so far. Because a \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length \u003ctt\u003eCONTINUATION\u003c/tt\u003e frames adds no bytes to the running total, never trips the size cap, and never emits \u003ctt\u003eEND_HEADERS\u003c/tt\u003e, yet each frame still nests the accumulator one level deeper.\u003c/p\u003e\u003cp\u003eA malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a \u003ctt\u003eHEADERS\u003c/tt\u003e frame without \u003ctt\u003eEND_HEADERS\u003c/tt\u003e and then stream zero-length \u003ctt\u003eCONTINUATION\u003c/tt\u003e frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.1.0 before 1.9.2.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.\n\nThe Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper.\n\nA malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.\n\nThis issue affects mint: from 0.1.0 before 1.9.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:08:39.463Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59246.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59246"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-mint/mint/commit/5779de1666344b32aefc4354184ea07f902f73ce"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zero-length HTTP/2 CONTINUATION frames bypass Mint\u0027s header-block byte-size cap and exhaust client memory",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59246",
"datePublished": "2026-07-14T08:37:04.609Z",
"dateReserved": "2026-07-04T04:24:03.652Z",
"dateUpdated": "2026-07-14T15:08:39.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58229 (GCVE-0-2026-58229)
Vulnerability from cvelistv5 – Published: 2026-07-14 08:36 – Updated: 2026-07-14 15:07
VLAI
EPSS
VEX
Title
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
Summary
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.
A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.
This issue affects mint: from 0.1.0 before 1.9.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-mint/mint/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-58229.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-58229 | related |
| https://github.com/elixir-mint/mint/commit/566d70… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-mint | mint |
Affected:
0.1.0 , < 1.9.2
(semver)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
|
| elixir-mint | mint |
Affected:
3e6de4bac4821b0eb4d6109e8b1f3fb6458792c8 , < 566d702e6f29105f77522ca7aabb9f64f2f4e333
(git)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T12:27:10.055823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:27:15.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-qrfr-wh4c-3qhw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "mint",
"packageURL": "pkg:hex/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_headers/5"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_trailer_headers/4"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "1.9.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "elixir-mint/mint",
"packageURL": "pkg:github/elixir-mint/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_headers/5"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_trailer_headers/4"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "566d702e6f29105f77522ca7aabb9f64f2f4e333",
"status": "affected",
"version": "3e6de4bac4821b0eb4d6109e8b1f3fb6458792c8",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx (Jace)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrea Leopardi"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003eMint.HTTP1.decode_headers/5\u003c/tt\u003e and \u003ctt\u003eMint.HTTP1.decode_trailer_headers/4\u003c/tt\u003e functions in \u003ctt\u003elib/mint/http1.ex\u003c/tt\u003e accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as \u003ctt\u003erequest.headers_buffer\u003c/tt\u003e, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying \u003ctt\u003e:erlang.decode_packet(:httph_bin, binary, [])\u003c/tt\u003e parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.\u003c/p\u003e\u003cp\u003eA malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system\u0027s out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.1.0 before 1.9.2.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.\n\nThe Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.\n\nA malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system\u0027s out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.\n\nThis issue affects mint: from 0.1.0 before 1.9.2."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:07:57.359Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-qrfr-wh4c-3qhw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-58229.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-58229"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-mint/mint/commit/566d702e6f29105f77522ca7aabb9f64f2f4e333"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-58229",
"datePublished": "2026-07-14T08:36:54.616Z",
"dateReserved": "2026-06-29T18:54:08.633Z",
"dateUpdated": "2026-07-14T15:07:57.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58228 (GCVE-0-2026-58228)
Vulnerability from cvelistv5 – Published: 2026-07-13 18:04 – Updated: 2026-07-14 04:15
VLAI
EPSS
VEX
Title
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
Summary
Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.
The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.
Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session.
Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected.
This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/phoenixframework/phoenix_live_… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-58228.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-58228 | related |
| https://github.com/phoenixframework/phoenix_live_… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| phoenixframework | phoenix_live_view |
Affected:
1.2.2 , < 1.2.7
(semver)
cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:* |
|
| phoenixframework | phoenix_live_view |
Affected:
4b63216ae68886db99cf7772af23372d76c40e7e , < 86165533e311469a1b62093fd182d9d874de8106
(git)
cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T18:58:11.563760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T18:58:51.407Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/phoenixframework/phoenix_live_view/security/advisories/GHSA-5cgh-g58j-m9cq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Phoenix.LiveView.Utils\u0027"
],
"packageName": "phoenix_live_view",
"packageURL": "pkg:hex/phoenix_live_view",
"product": "phoenix_live_view",
"programFiles": [
"lib/phoenix_live_view/utils.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Phoenix.LiveView.Utils\u0027:valid_destination!/2"
},
{
"name": "\u0027Elixir.Phoenix.LiveView.Utils\u0027:valid_live_navigation_destination!/2"
}
],
"repo": "https://github.com/phoenixframework/phoenix_live_view",
"vendor": "phoenixframework",
"versions": [
{
"lessThan": "1.2.7",
"status": "affected",
"version": "1.2.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Phoenix.LiveView.Utils\u0027"
],
"packageName": "phoenixframework/phoenix_live_view",
"packageURL": "pkg:github/phoenixframework/phoenix_live_view",
"product": "phoenix_live_view",
"programFiles": [
"lib/phoenix_live_view/utils.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Phoenix.LiveView.Utils\u0027:valid_destination!/2"
},
{
"name": "\u0027Elixir.Phoenix.LiveView.Utils\u0027:valid_live_navigation_destination!/2"
}
],
"repo": "https://github.com/phoenixframework/phoenix_live_view",
"vendor": "phoenixframework",
"versions": [
{
"lessThan": "86165533e311469a1b62093fd182d9d874de8106",
"status": "affected",
"version": "4b63216ae68886db99cf7772af23372d76c40e7e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.7",
"versionStartIncluding": "1.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Barna Kovacs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Steffen Deusch"
},
{
"lang": "en",
"type": "analyst",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim\u0027s browser session.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ePhoenix.LiveView.Utils.valid_destination!/2\u003c/tt\u003e and \u003ctt\u003ePhoenix.LiveView.Utils.valid_live_navigation_destination!/2\u003c/tt\u003e functions in \u003ctt\u003elib/phoenix_live_view/utils.ex\u003c/tt\u003e rely on an internal \u003ctt\u003euri_scheme/1\u003c/tt\u003e helper that only detects a scheme when the input\u0027s first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.\u003c/p\u003e\u003cp\u003eStandard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as \u003ctt\u003e\u0026quot; javascript:alert(1)\u0026quot;\u003c/tt\u003e is passed unchanged into \u003ctt\u003e\u0026lt;.link href={...}\u0026gt;\u003c/tt\u003e and, when clicked, is parsed by the browser as a \u003ctt\u003ejavascript:\u003c/tt\u003e URL that executes attacker-controlled script in the victim\u0027s session.\u003c/p\u003e\u003cp\u003eApplications that render user-supplied URLs (for example profile links, redirect targets, or external references) via \u003ctt\u003e\u0026lt;.link href={...}\u0026gt;\u003c/tt\u003e are affected.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_live_view: from 1.2.2 before 1.2.7.\u003c/p\u003e"
}
],
"value": "Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim\u0027s browser session.\n\nThe Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input\u0027s first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.\n\nStandard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as \" javascript:alert(1)\" is passed unchanged into \u003c.link href={...}\u003e and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim\u0027s session.\n\nApplications that render user-supplied URLs (for example profile links, redirect targets, or external references) via \u003c.link href={...}\u003e are affected.\n\nThis issue affects phoenix_live_view: from 1.2.2 before 1.2.7."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T04:15:01.996Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/phoenixframework/phoenix_live_view/security/advisories/GHSA-5cgh-g58j-m9cq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-58228.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-58228"
},
{
"tags": [
"patch"
],
"url": "https://github.com/phoenixframework/phoenix_live_view/commit/86165533e311469a1b62093fd182d9d874de8106"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via \u003c.link\u003e",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStrip leading ASCII control and space bytes (code points 0x00 through 0x20) from any untrusted URL before passing it to \u003ctt\u003e\u0026lt;.link href={...}\u0026gt;\u003c/tt\u003e, or reject such inputs outright. This aligns application-level validation with the WHATWG URL parser used by browsers and prevents the scheme-detection bypass.\u003c/p\u003e"
}
],
"value": "Strip leading ASCII control and space bytes (code points 0x00 through 0x20) from any untrusted URL before passing it to \u003c.link href={...}\u003e, or reject such inputs outright. This aligns application-level validation with the WHATWG URL parser used by browsers and prevents the scheme-detection bypass."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-58228",
"datePublished": "2026-07-13T18:04:30.636Z",
"dateReserved": "2026-06-29T18:54:08.633Z",
"dateUpdated": "2026-07-14T04:15:01.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56813 (GCVE-0-2026-56813)
Vulnerability from cvelistv5 – Published: 2026-07-10 12:51 – Updated: 2026-07-10 14:45
VLAI
EPSS
VEX
Title
Cookie attribute injection in Plug.Conn.Cookies.encode/2
Summary
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.
The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.
An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.
This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-141 - Improper Neutralization of Parameter/Argument Delimiters
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/elixir-plug/plug/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-56813.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-56813 | related |
| https://github.com/elixir-plug/plug/commit/c65758… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-plug | plug |
Affected:
0.1.0 , < 1.16.6
(semver)
Affected: 1.17.0 , < 1.17.4 (semver) Affected: 1.18.0 , < 1.18.5 (semver) Affected: 1.19.0 , < 1.19.5 (semver) Affected: 1.20.0 , < 1.20.3 (semver) cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* |
|
| elixir-plug | plug |
Affected:
f26876aa67aaeb38e616638aa3efbcc2fe2906a5 , < *
(git)
cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:43:36.298825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:43:45.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Plug.Conn.Cookies\u0027",
"\u0027Elixir.Plug.Conn\u0027"
],
"packageName": "plug",
"packageURL": "pkg:hex/plug",
"product": "plug",
"programFiles": [
"lib/plug/conn/cookies.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Plug.Conn.Cookies\u0027:encode/2"
},
{
"name": "\u0027Elixir.Plug.Conn\u0027:put_resp_cookie/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"versions": [
{
"lessThan": "1.16.6",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
},
{
"lessThan": "1.17.4",
"status": "affected",
"version": "1.17.0",
"versionType": "semver"
},
{
"lessThan": "1.18.5",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
},
{
"lessThan": "1.19.5",
"status": "affected",
"version": "1.19.0",
"versionType": "semver"
},
{
"lessThan": "1.20.3",
"status": "affected",
"version": "1.20.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Plug.Conn.Cookies\u0027",
"\u0027Elixir.Plug.Conn\u0027"
],
"packageName": "elixir-plug/plug",
"packageURL": "pkg:github/elixir-plug/plug",
"product": "plug",
"programFiles": [
"lib/plug/conn/cookies.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Plug.Conn.Cookies\u0027:encode/2"
},
{
"name": "\u0027Elixir.Plug.Conn\u0027:put_resp_cookie/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"versions": [
{
"changes": [
{
"at": "3f00dfad4e20ba88472e315c90a25742bf178f8e",
"status": "unaffected"
},
{
"at": "a6d1248659022749869963fd302687165ecf8c8b",
"status": "unaffected"
},
{
"at": "4167981747fe9ce75f374b94a28861ae950ea992",
"status": "unaffected"
},
{
"at": "149d9ed68fee0b4f77efd1e835ce5d785856697b",
"status": "unaffected"
},
{
"at": "eceb8315ce9a31ef784943a95a8624ebd1bc7e06",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "f26876aa67aaeb38e616638aa3efbcc2fe2906a5",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.16.6",
"versionStartIncluding": "0.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17.4",
"versionStartIncluding": "1.17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.5",
"versionStartIncluding": "1.18.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.5",
"versionStartIncluding": "1.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.3",
"versionStartIncluding": "1.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ePlug.Conn.Cookies.encode/2\u003c/tt\u003e function in \u003ctt\u003elib/plug/conn/cookies.ex\u003c/tt\u003e builds the \u003ctt\u003eSet-Cookie\u003c/tt\u003e response header by interpolating the cookie value and its \u003ctt\u003epath\u003c/tt\u003e, \u003ctt\u003edomain\u003c/tt\u003e, \u003ctt\u003esame_site\u003c/tt\u003e, and \u003ctt\u003eextra\u003c/tt\u003e attributes directly into the header without neutralizing the \u003ctt\u003e;\u003c/tt\u003e delimiter that separates cookie attributes.\u003c/p\u003e\u003cp\u003eAn application that places attacker-controlled data into a cookie value or attribute (for example via \u003ctt\u003ePlug.Conn.put_resp_cookie/4\u003c/tt\u003e when reflecting a username or preference) lets an attacker inject a \u003ctt\u003e;\u003c/tt\u003e to append or override cookie attributes (such as \u003ctt\u003eDomain\u003c/tt\u003e and \u003ctt\u003ePath\u003c/tt\u003e scope, or dropping the \u003ctt\u003eSecure\u003c/tt\u003e and \u003ctt\u003eHttpOnly\u003c/tt\u003e flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by \u003ctt\u003ePlug.Conn\u003c/tt\u003e header validation, so HTTP response splitting is not possible, but attribute injection through \u003ctt\u003e;\u003c/tt\u003e is not prevented.\u003c/p\u003e\u003cp\u003eThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the \u0027;\u0027 delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a \u0027;\u0027 to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through \u0027;\u0027 is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3."
}
],
"impacts": [
{
"capecId": "CAPEC-61",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-61 Session Fixation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-141",
"description": "CWE-141 Improper Neutralization of Parameter/Argument Delimiters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:45:34.174Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-56813.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56813"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cookie attribute injection in Plug.Conn.Cookies.encode/2",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eValidate or reject the \u003ctt\u003e;\u003c/tt\u003e delimiter in any untrusted data before passing it as a cookie value or attribute to \u003ctt\u003ePlug.Conn.put_resp_cookie/4\u003c/tt\u003e or \u003ctt\u003ePlug.Conn.Cookies.encode/2\u003c/tt\u003e. Carriage return, line feed, and null bytes are already rejected by \u003ctt\u003ePlug.Conn\u003c/tt\u003e header validation.\u003c/p\u003e"
}
],
"value": "Validate or reject the \u0027;\u0027 delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-56813",
"datePublished": "2026-07-10T12:51:08.758Z",
"dateReserved": "2026-06-23T12:29:02.507Z",
"dateUpdated": "2026-07-10T14:45:34.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56814 (GCVE-0-2026-56814)
Vulnerability from cvelistv5 – Published: 2026-07-10 11:14 – Updated: 2026-07-10 14:41
VLAI
EPSS
VEX
Title
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
Summary
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.
Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.
This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.
This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-plug | plug |
Affected:
1.4.0 , < 1.16.6
(semver)
Affected: 1.17.0 , < 1.17.4 (semver) Affected: 1.18.0 , < 1.18.5 (semver) Affected: 1.19.0 , < 1.19.5 (semver) Affected: 1.20.0 , < 1.20.3 (semver) cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* |
|
| elixir-plug | plug |
Affected:
c52b2f32c90bccd718202bafccb5f95594e30183 , < *
(git)
cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:03:11.744626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:03:28.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Plug.Parsers.MULTIPART\u0027"
],
"packageName": "plug",
"packageURL": "pkg:hex/plug",
"product": "plug",
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart/2"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_headers/5"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_body/4"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_file/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"versions": [
{
"lessThan": "1.16.6",
"status": "affected",
"version": "1.4.0",
"versionType": "semver"
},
{
"lessThan": "1.17.4",
"status": "affected",
"version": "1.17.0",
"versionType": "semver"
},
{
"lessThan": "1.18.5",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
},
{
"lessThan": "1.19.5",
"status": "affected",
"version": "1.19.0",
"versionType": "semver"
},
{
"lessThan": "1.20.3",
"status": "affected",
"version": "1.20.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Plug.Parsers.MULTIPART\u0027"
],
"packageName": "elixir-plug/plug",
"packageURL": "pkg:github/elixir-plug/plug",
"product": "plug",
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart/2"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_headers/5"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_body/4"
},
{
"name": "\u0027Elixir.Plug.Parsers.MULTIPART\u0027:parse_multipart_file/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"versions": [
{
"changes": [
{
"at": "981597d3a4271ede64373c7a731702a42c500dd6",
"status": "unaffected"
},
{
"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e",
"status": "unaffected"
},
{
"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f",
"status": "unaffected"
},
{
"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364",
"status": "unaffected"
},
{
"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc",
"status": "unaffected"
},
{
"at": "df97d3f17f808a9916a7700a701fb85314559d56",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "c52b2f32c90bccd718202bafccb5f95594e30183",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.16.6",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17.4",
"versionStartIncluding": "1.17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.5",
"versionStartIncluding": "1.18.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.5",
"versionStartIncluding": "1.19.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.3",
"versionStartIncluding": "1.20.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ctt\u003ePlug.Parsers.MULTIPART\u003c/tt\u003e, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its \u003ctt\u003e:length\u003c/tt\u003e budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the \u003ctt\u003e:length\u003c/tt\u003e limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\u003c/p\u003e\u003cp\u003eBecause every part whose \u003ctt\u003eContent-Disposition\u003c/tt\u003e carries a non-empty \u003ctt\u003efilename\u003c/tt\u003e creates a fresh temporary file (via \u003ctt\u003ePlug.Upload\u003c/tt\u003e) and retains a \u003ctt\u003ePlug.Upload\u003c/tt\u003e struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured \u003ctt\u003e:length\u003c/tt\u003e limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using \u003ctt\u003ePlug.Parsers\u003c/tt\u003e with the \u003ctt\u003e:multipart\u003c/tt\u003e parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/plug/parsers/multipart.ex\u003c/tt\u003e and program routines \u003ctt\u003ePlug.Parsers.MULTIPART.parse_multipart/2\u003c/tt\u003e, \u003ctt\u003ePlug.Parsers.MULTIPART.parse_multipart_headers/5\u003c/tt\u003e, \u003ctt\u003ePlug.Parsers.MULTIPART.parse_multipart_body/4\u003c/tt\u003e, and \u003ctt\u003ePlug.Parsers.MULTIPART.parse_multipart_file/4\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.\u003c/p\u003e"
}
],
"value": "Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nThis issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:41:43.299Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-56814.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56814"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-56814",
"datePublished": "2026-07-10T11:14:35.574Z",
"dateReserved": "2026-06-23T12:29:02.507Z",
"dateUpdated": "2026-07-10T14:41:43.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}