Every CVE Search/ Get API key

CVE-2026-28808

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

8.3 HighFix available

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.57%Up 0.5 points since Apr 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
CVE-2026-28808
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863, CWE-551
Updated
2026-11-02
EUVDEUVD-2026-19602 8.3

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
EUVD-2026-19602
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.3

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
CVE-2026-28808
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863, CWE-551
Updated
2026-11-02
OSV 8.3

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
CVE-2026-28808
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVDEBIAN-CVE-2026-28808 9.8

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
DEBIAN-CVE-2026-28808
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVEEF-CVE-2026-28808 8.3

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Summary

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Workarounds

  • Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path.
  • Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix.
  • Remove mod_cgi from the httpd modules chain if CGI functionality is not required.

Configurations

The inets httpd server must use script_alias to map a URL prefix to a CGI directory, combined with directory-based access controls (e.g., mod_auth) protecting the script_alias target path. The vulnerability applies whenever the script_alias target path differs from DocumentRoot + URL prefix.

Record
EEF-CVE-2026-28808
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2026-2572 9.8

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.(CVE-2026-28808)

Record
OESA-2026-2572
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2573 9.8

erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.(CVE-2026-28808)

Record
OESA-2026-2573
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-28808 8.3

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
UBUNTU-CVE-2026-28808
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-83390 No score

CVE-2026-28808 affecting package erlang for versions less than 26.2.5.19-1

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Record
AZL-83390
Updated
2026-11-02
OSVopenSUSE-SU-2026:10947-1 No score

erlang27-27.1.3-2.1 on GA media

These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10947-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11559-1 No score

erlang-28.5.0.4-1.1 on GA media

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11559-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20607-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Security issues fixed:

  • CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote arbitrary reads/writes (bsc#1258663).
  • CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request smuggling (bsc#1259687).
  • CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path traversal (bsc#1259681).
  • CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service (bsc#1259682).
  • CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
  • CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
  • CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure (bsc#1261734).

Other updates and bugfixes:

  • jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).
Record
openSUSE-SU-2026:20607-1
Updated
2026-11-02
OSVSUSE-SU-2026:1714-1 No score

Security update for erlang

This update for erlang fixes the following issues:

  • CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).
  • CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).
  • CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).
  • CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).
  • CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
Record
SUSE-SU-2026:1714-1
Updated
2026-11-02
OSVSUSE-SU-2026:2010-1 No score

Security update for erlang26

This update for erlang26 fixes the following issues

Security issues:

  • CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).
  • CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).
  • CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).
  • CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).
  • CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
  • CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).

Non security issue:

  • Fixes for FIPS mode (jsc#PED-15166.
Record
SUSE-SU-2026:2010-1
Updated
2026-11-02
OSVSUSE-SU-2026:21374-1 No score

Security update for erlang

This update for erlang fixes the following issues:

Security issues fixed:

  • CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote arbitrary reads/writes (bsc#1258663).
  • CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request smuggling (bsc#1259687).
  • CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path traversal (bsc#1259681).
  • CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service (bsc#1259682).
  • CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
  • CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
  • CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure (bsc#1261734).

Other updates and bugfixes:

  • jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).
Record
SUSE-SU-2026:21374-1
Updated
2026-11-02
OSVUSN-8901-1 No score

erlang vulnerabilities

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-26618)

It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)

It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root directory. An authenticated user could possibly use this issue to access files outside of the root directory. (CVE-2026-23942)

It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-23943)

It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts served via script aliases. A remote attacker could possibly use this issue to bypass authentication and access protected CGI scripts. (CVE-2026-28808)

It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file handles. An authenticated user could possibly use this issue to modify the attributes of files outside of the root directory. (CVE-2026-32147)

It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A remote attacker could possibly use this issue to bypass certificate validation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42790)

It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses using an expired responder certificate. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-47078)

It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An…

Record
USN-8901-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Azure Linux:3
 before 26.2.5.19-1
26.2.5.19-1
erlang
Debian:12
 All versions, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u4
Show 45 moreShow less
1:25.3.2.10+dfsg-11:25.3.2.10+dfsg-21:25.3.2.11+dfsg-11:25.3.2.12+dfsg-11:25.3.2.12+dfsg-21:25.3.2.12+dfsg-31:25.3.2.8+dfsg-11:26.0+dfsg-11:26.0.1+dfsg-11:26.0.2+dfsg-11:26.0~rc2+dfsg-11:26.0~rc3+dfsg-11:26.1.2+dfsg-11:26.2.1+dfsg-11:26.2.4+dfsg-11:27.0+dfsg-11:27.0.1+dfsg-11:27.0.1+dfsg-21:27.0.1+dfsg-31:27.0~rc3+dfsg-11:27.0~rc3+dfsg-21:27.0~rc3+dfsg-31:27.0~rc3+dfsg-41:27.1.2+dfsg-11:27.2+dfsg-11:27.2+dfsg-21:27.2+dfsg-3~exp11:27.2.1+dfsg-11:27.2.1+dfsg-21:27.2.2+dfsg-11:27.2.3+dfsg-11:27.2.4+dfsg-11:27.3+dfsg-11:27.3.1+dfsg-11:27.3.2+dfsg-11:27.3.3+dfsg-11:27.3.4+dfsg-11:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-6
 None known
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u3, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1+deb13u11:27.3.4.1+dfsg-1+deb13u2
1:27.3.4.1+dfsg-1+deb13u3
erlang
Debian:14
 before 1:27.3.4.10+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-1
1:27.3.4.10+dfsg-1
erlang
openEuler:24.03-LTS-SP1
 before 25.3.2.6-15.oe2403sp1
25.3.2.6-15.oe2403sp1
erlang
openEuler:24.03-LTS-SP3
 before 25.3.2.6-15.oe2403sp3
25.3.2.6-15.oe2403sp3
erlang
Ubuntu:Pro:14.04:LTS
 before 1:16.b.3-dfsg-1ubuntu2.2+esm3, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu2
Show 4 moreShow less
1:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm11:16.b.3-dfsg-1ubuntu2.2+esm2
1:16.b.3-dfsg-1ubuntu2.2+esm3
erlang
Ubuntu:Pro:16.04:LTS
 before 1:18.3-dfsg-1ubuntu3.1+esm4, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 5 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm21:18.3-dfsg-1ubuntu3.1+esm3
1:18.3-dfsg-1ubuntu3.1+esm4
erlang
Ubuntu:Pro:18.04:LTS
 before 1:20.2.2+dfsg-1ubuntu2+esm4, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm21:20.2.2+dfsg-1ubuntu2+esm3
1:20.2.2+dfsg-1ubuntu2+esm4
erlang
Ubuntu:Pro:20.04:LTS
 before 1:22.2.7+dfsg-1ubuntu0.5+esm3, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 9 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm11:22.2.7+dfsg-1ubuntu0.5+esm2
1:22.2.7+dfsg-1ubuntu0.5+esm3
Show 14 moreShow less
Affected packages
PackageAffectedFixed
erlang
Ubuntu:22.04:LTS
 before 1:24.2.1+dfsg-1ubuntu0.8, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 9 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.61:24.2.1+dfsg-1ubuntu0.7
1:24.2.1+dfsg-1ubuntu0.8
erlang
Ubuntu:24.04:LTS
 before 1:25.3.2.8+dfsg-1ubuntu4.8, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 7 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.61:25.3.2.8+dfsg-1ubuntu4.7
1:25.3.2.8+dfsg-1ubuntu4.8
erlang
Ubuntu:25.10
 All versions, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build11:27.3.4.1+dfsg-1ubuntu0.1
 None known
erlang
Ubuntu:26.04:LTS
 before 1:27.3.4.6+dfsg-1ubuntu0.2, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.6+dfsg-1ubuntu0.1
1:27.3.4.6+dfsg-1ubuntu0.2
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 30 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm3, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu2
Show 4 moreShow less
1:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm11:16.b.3-dfsg-1ubuntu2.2+esm2
1:16.b.3-dfsg-1ubuntu2.2+esm3
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 30 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm4, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 5 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm21:18.3-dfsg-1ubuntu3.1+esm3
1:18.3-dfsg-1ubuntu3.1+esm4
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 30 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm4, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm21:20.2.2+dfsg-1ubuntu2+esm3
1:20.2.2+dfsg-1ubuntu2+esm4
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 30 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm3, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 9 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm11:22.2.7+dfsg-1ubuntu0.5+esm2
1:22.2.7+dfsg-1ubuntu0.5+esm3
erlang
Ubuntu:22.04:LTS
From an advisory covering 30 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.8, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 9 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.61:24.2.1+dfsg-1ubuntu0.7
1:24.2.1+dfsg-1ubuntu0.8
erlang
Ubuntu:24.04:LTS
From an advisory covering 30 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.8, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 7 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.61:25.3.2.8+dfsg-1ubuntu4.7
1:25.3.2.8+dfsg-1ubuntu4.8
erlang
Ubuntu:26.04:LTS
From an advisory covering 30 CVEs
 before 1:27.3.4.6+dfsg-1ubuntu0.2, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.6+dfsg-1ubuntu0.1
1:27.3.4.6+dfsg-1ubuntu0.2
erlang27
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 27.1.3-2.1
27.1.3-2.1
erlang
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 28.5.0.4-1.1
28.5.0.4-1.1
erlang
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 27.1.3-160000.4.1
27.1.3-160000.4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28808 is a high vulnerability (CVSS 8.3) in Erlang Otp, published April 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in erlang 26.2.5.19-1.

References

Show 89 moreShow less
This page doesn't list everything

Left out here: 31 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open