Erlang/OTP snmp CVE-2026-70405

Exploitation requires network-level access to UDP port 161 on a host running an affected Erlang/OTP SNMP agent. For SNMPv1 and SNMPv2c deployments, knowledge of the community string - frequently the default value 'public' in unmodified configurations - is the only prerequisite beyond network reachability, as BER decoding of the PDU occurs before community string enforcement according to the advisory. Whether SNMPv3 message-level authentication occurs before the vulnerable PDU decoding path is triggered is not explicitly confirmed by the advisory; defenders should verify this boundary in their specific OTP version before treating SNMPv3 as a reliable mitigating control. The vulnerability is not limited to a specific PDU type - GetRequest, SetRequest, InformRequest, Trap, and any PDU containing varbind values decoded by dec_value/1 are all affected. No prior session state, established connection, or semantically valid OID is required; the malformed length field alone triggers the unbounded work.

The provided CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects a network-exploitable, unauthenticated availability issue rated at low impact with no confidentiality or integrity dimension. AT:P acknowledges that the SNMP service must be network-reachable; VA:L suggests the vendor assessed availability degradation as partial rather than complete. This assessment may understate operational risk: a single malformed UDP packet triggers superlinear CPU work before any rate-limiting or validation applies, and even modest packet repetition can sustain denial of the SNMP agent without significant attacker bandwidth. No EPSS score was supplied in the input, precluding probabilistic comparison against the CVSS signal. No KEV listing and no public PoC have been identified, indicating exploitation has not been observed in the wild at time of analysis. For infrastructure teams relying on SNMP for device polling and alerting, even brief agent unavailability can create monitoring blind spots during incidents. The CVSS 4.0 AT:P factor partially reflects deployment variability - organizations that have already firewalled SNMP to management-only networks experience meaningfully reduced exposure, while those with SNMP exposed to broader network segments face the full rated risk.

An attacker with network access to UDP port 161 on an SNMPv2c-enabled Erlang/OTP host sends a single GetRequest PDU in which a varbind value's BER INTEGER length field is set to several hundred megabytes; the SNMP agent's dec_integer_notag/1 immediately begins recursive bignum accumulation before any community string check or PDU validity check occurs, locking the agent's Erlang process on CPU-intensive big-integer arithmetic and rendering it unresponsive to all legitimate SNMP polling. Repeating the packet at low frequency sustains denial of service without requiring significant attacker bandwidth or a valid OID. No public PoC has been identified, but the attack primitive is straightforward to construct from the advisory description alone.