CVE-2016-1000107
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not...
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
CVE-2016-1000107- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
CVE-2016-1000107- Updated
- 2026-11-02
EUVDEUVD-2016-1052 No score
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
EUVD-2016-1052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v875-g963-fhg4
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not...
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
GHSA-v875-g963-fhg4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
CVE-2016-1000107- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1000107
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
DEBIAN-CVE-2016-1000107- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1000107
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Record
UBUNTU-CVE-2016-1000107- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15706-1 No score
erlang-28.1.1-1.1 on GA media
These are all security issues fixed in the erlang-28.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15706-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
erlangDebian:12 |
All versions, plus listed versions 1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u4 Show 45 moreShow less1:25.3.2.10+dfsg-11:25.3.2.10+dfsg-21:25.3.2.11+dfsg-11:25.3.2.12+dfsg-11:25.3.2.12+dfsg-21:25.3.2.12+dfsg-31:25.3.2.8+dfsg-11:26.0+dfsg-11:26.0.1+dfsg-11:26.0.2+dfsg-11:26.0~rc2+dfsg-11:26.0~rc3+dfsg-11:26.1.2+dfsg-11:26.2.1+dfsg-11:26.2.4+dfsg-11:27.0+dfsg-11:27.0.1+dfsg-11:27.0.1+dfsg-21:27.0.1+dfsg-31:27.0~rc3+dfsg-11:27.0~rc3+dfsg-21:27.0~rc3+dfsg-31:27.0~rc3+dfsg-41:27.1.2+dfsg-11:27.2+dfsg-11:27.2+dfsg-21:27.2+dfsg-3~exp11:27.2.1+dfsg-11:27.2.1+dfsg-21:27.2.2+dfsg-11:27.2.3+dfsg-11:27.2.4+dfsg-11:27.3+dfsg-11:27.3.1+dfsg-11:27.3.2+dfsg-11:27.3.3+dfsg-11:27.3.4+dfsg-11:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-6 |
None known |
erlangDebian:13 |
before 1:27.3.4.1+dfsg-1+deb13u1, plus listed versions 1:27.3.4.1+dfsg-1 |
1:27.3.4.1+dfsg-1+deb13u1 |
erlangDebian:14 |
before 1:27.3.4.3+dfsg-1, plus listed versions 1:27.3.4.1+dfsg-1 |
1:27.3.4.3+dfsg-1 |
erlangUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu2 Show 5 moreShow less1:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm11:16.b.3-dfsg-1ubuntu2.2+esm21:16.b.3-dfsg-1ubuntu2.2+esm3 |
None known |
erlangUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2 Show 6 moreShow less1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm21:18.3-dfsg-1ubuntu3.1+esm31:18.3-dfsg-1ubuntu3.1+esm4 |
None known |
erlangopenSUSE:Tumbleweed |
before 28.1.1-1.1 | 28.1.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000107 is a medium vulnerability (CVSS 6.1) in Erlang Erlang\/otp, published December 10, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in erlang 1:27.3.4.1+dfsg-1+deb13u1.
References
httpoxy.org
security-tracker.debian.org/tracker/CVE-2016-1000107
openwall.com/lists/oss-security/2016/07/18/6
bugs.erlang.org/browse/ERL-198
nvd.nist.gov/vuln/detail/CVE-2016-1000107
github.com/advisories/GHSA-v875-g963-fhg4
ubuntu.com/security/CVE-2016-1000107
cve.org/CVERecord?id=CVE-2016-1000107
suse.com/security/cve/CVE-2016-1000107
Left out here: 29 versions. The JSON record has them.