Skip to main content

Erlang CVE-2026-28810

| EUVDEUVD-2026-19582 MEDIUM
Generation of Predictable Numbers or Identifiers (CWE-340)
2026-04-07 EEF
Information Disclosure Otp Erlang
6.3
CVSS 4.0 · Vendor: EEF
View

Vulnerability Assessment

Weakness
CWE
CWE-340
Impact

CVSS 6.3 with moderate attack complexity (AC:H) reflects the requirement for attackers to either observe queries or successfully predict transaction IDs, but the practical exploitability is significant: any attacker with network visibility (on-path or able to trigger queries) can perform cache poisoning. EPSS exploitation probability data not provided, but the vulnerability aligns with SSVC high technical impact (integrity of DNS responses affects all downstream services relying on that resolver). KEV status not confirmed in input; no public POC identified at time of analysis. The real-world risk depends heavily on deployment context: systems using inet_res in trusted networks (internal corporate DNS) face minimal risk, while internet-facing or cloud deployments face substantial risk. This is a classic design-limitation vulnerability rather than a memory corruption or code execution flaw, making it lower priority than CVSS alone suggests, but nonetheless critical for affected deployments in adversarial networks.
Exploit ScenarioDerived

An attacker on the network path between a vulnerable Erlang/OTP application using inet_res and the recursive resolver observes a DNS query for example.com and notes the sequential transaction ID (e.g., ID=0x1234). The attacker immediately sends a spoofed DNS response with the same ID, claiming example.com resolves to the attacker's IP. Because inet_res does not randomize the source port and relies solely on the predictable ID, the spoofed response is accepted and cached. Subsequent application requests for example.com are redirected to the attacker, enabling phishing, credential theft, or malware delivery. Alternatively, an attacker who triggers an application to perform a DNS lookup can predict the next transaction ID (e.g., 0x1235) with high confidence and preemptively send a spoofed response before the legitimate answer arrives.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Erlang/OTP kernel inet_res DNS resolver uses predictable sequential transaction IDs and lacks source port randomization, enabling DNS cache poisoning attacks against systems relying on this resolver in untrusted network environments. Affects OTP 17.0 through 28.4.2 (and specific patch versions 27.3.4.10, 26.2.5.19); unauthenticated remote attackers who can observe or predict DNS query patterns can forge DNS responses to redirect traffic or execute man-in-the-middle attacks. Vendor-released patches available; no public exploit code or active exploitation confirmed.

RemediationAI

Upgrade Erlang/OTP to patched versions: OTP 28.4.2 or later, OTP 27.3.4.10 or later, or OTP 26.2.5.19 or later. Vendor-released patches are available via the commits listed at https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5, https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd, and https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8. For deployments unable to immediately upgrade, mitigate by restricting inet_res use to trusted network segments with trusted recursive DNS resolvers only, or replacing inet_res with an external DNS resolver (e.g., systemd-resolved or OS-native resolver). Review https://www.erlang.org/doc/system/versions.html#order-of-versions for release timeline and patching paths.

Affected VersionsENISA

otp 3.0 <*
otp 07b8f441ca711f9812fad9e9115bab3c3aa92f79 <*
otp 17.0 <*

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Erlang/OTP built-in DNS resolver (inet_res module in lib/kernel/src) implements RFC 1035 DNS over UDP but violates RFC 5452 mitigations against forged DNS answers. The vulnerability stems from CWE-340 (Generation of Predictable Numbers or Identifiers) in the transaction ID generation mechanism. Instead of randomizing both the 16-bit transaction ID (query ID) and the source UDP port - the two primary defenses against DNS spoofing - inet_res generates a process-global sequential transaction ID that is trivially predictable. Response validation relies almost entirely on matching this ID, leaving systems vulnerable if an attacker can observe a single query (to learn the current ID sequence) or predict the next transaction ID. The inet_res resolver was designed for trusted network environments with trusted recursive resolvers, but earlier documentation did not clearly communicate this deployment constraint, potentially leading to unsafe deployments in Internet-facing or untrusted-network scenarios.

Know when Erlang gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (EEF) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 5.3 MEDIUM

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 07, 2026 - 08:30 nvd
Patch available
CVE Published
Apr 07, 2026 - 07:50 nvd
MEDIUM 6.3

DescriptionCVE.org

Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.

The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.

inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.

This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to kernel from 3.0 until 10.6.2, 10.2.7.4 and 9.2.4.11.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Erlang/OTP Security Issues

View all 3
CVE-2026-32144 HIGH
7.6
CVE-2026-28808 HIGH
8.3

More in Erlang

View all
CVE-2025-32433 CRITICAL POC
10.0 Apr 16

Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling
CVE-2017-1000385 MEDIUM POC
5.9 Dec 12

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Rat
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2020-13802 CRITICAL POC
9.8 Sep 02

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specificat
CVE-2014-1693 HIGH POC
7.5 Dec 08

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inje
CVE-2021-29221 HIGH POC
7.0 Apr 09

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. Rated high severity (CV
CVE-2016-10253 CRITICAL
9.8 Mar 18

An issue was discovered in Erlang/OTP 18.x. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-37026 CRITICAL
9.8 Sep 21

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th

Same weakness CWE-340 – Generation of Predictable Numbers or Identifiers

View all
CVE-2024-47945 CRITICAL POC
9.8
CVE-2025-69286 HIGH POC
8.9
CVE-2025-15604 CRITICAL
9.8
CVE-2026-3256 CRITICAL
9.8
CVE-2026-85496 HIGH
7.7
CVE-2026-75106 CRITICAL
9.3
CVE-2026-11374 CRITICAL
9.0
CVE-2026-9733 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5 PATCH https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8 PATCH https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd ADVISORY https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8 ADVISORY https://vuldb.com/vuln/355721 REF https://cna.erlef.org/cves/CVE-2026-28810.html REF https://osv.dev/vulnerability/EEF-CVE-2026-28810 REF https://www.erlang.org/doc/system/versions.html#order-of-versions

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy