Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

2026-09-01 · CVE-2026-55951, CVE-2026-59696, CVE-2026-66357, CVE-2026-66835, CVE-2026-69664, CVE-2026-70399, CVE-2026-70405, CVE-2026-70409, CVE-2026-71380, CVE-2026-71562, CVE-2026-73270, CVE-2026-73276, CVE-2026-73812, CVE-2026-74835, CVE-2026-74994 · VuXML entry

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer Conversion. CVE-2026-66357: HTTP Request Smuggling via obs-fold Header Continuation in httpd. CVE-2026-66835: Possible …

Affected versions

• erlang < 28.5.0.6,4
• erlang-runtime27 < 27.3.4.17
• erlang-runtime28 < 28.5.0.6
• erlang-runtime29 < 29.0.6

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.