Erlang/OTP eldap CVE-2026-70409

Exploitation requires two simultaneous conditions: (1) the attacker must control or have compromised the LDAP server to which the target application connects - passive network interception of unencrypted LDAP traffic (port 389) would also satisfy this prerequisite; and (2) the application must explicitly pass server-supplied LDAP referral strings to eldap:parse_ldap_url/1. The second condition is the primary limiter: the CVE description explicitly states that eldap itself never calls parse_ldap_url/1 and returns referral strings to callers unparsed, meaning only application-layer code that implements LDAP referral chasing is affected. Default eldap usage without referral processing is not vulnerable regardless of LDAP server behavior. There is no authentication requirement on the victim side (PR:N), and no user interaction is needed once the application connects to the malicious server.

The CVSS 4.0 score of 6.3 with VA:L (low availability impact) and AT:P (attack prerequisites present) accurately reflects constrained real-world risk. Exploitation requires two concurrent conditions: attacker control of the LDAP server and an application that explicitly passes server-supplied referral strings to eldap:parse_ldap_url/1 - a non-default code path since eldap itself never invokes this function. The practical impact is service degradation (hundreds of milliseconds of stall per referral), not a complete denial of service or crash, making sustained exploitation a deliberate multi-request effort rather than a single-shot attack. No EPSS data is present in the input; no KEV listing exists; no public exploit code has been identified. This represents a moderate priority for Erlang applications that implement LDAP referral chasing, and effectively zero priority for applications that do not. The 'Information Disclosure' tag applied to this CVE in the source metadata is incorrect - the CVSS confirms zero confidentiality impact (VC:N), and the description describes availability degradation only.

An attacker who controls or compromises an LDAP server targeted by an Erlang application responds to LDAP search queries with referral responses embedding a port field containing approximately one million consecutive ASCII digits. When the application passes this referral string to eldap:parse_ldap_url/1, the unbounded list_to_integer/1 call in parse_port/2 consumes several hundred milliseconds of CPU time on the BEAM scheduler. By repeatedly issuing crafted referrals, the attacker sustains CPU saturation, degrading the availability of the LDAP client process and any dependent application logic. No public exploit code has been identified at time of analysis.