Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1000
Switch view
CWE-1000 at MITRE

We're looking at the CWE hierarchy through the Research Concepts view.

Improper Control of a Resource Through its Lifetime: 88 CVEs (54.0%) — click to drill down Improper Neutralization: 26 CVEs (16.0%) — click to drill down Improper Access Control: 20 CVEs (12.3%) — click to drill down Protection Mechanism Failure: 8 CVEs (4.9%) — click to drill down Improper Interaction Between Multiple Correctly-Behaving Entities: 7 CVEs (4.3%) — click to drill down Insufficient Control Flow Management: 7 CVEs (4.3%) — click to drill down Improper Check or Handling of Exceptional Conditions: 3 CVEs (1.8%) — click to drill down Improper Adherence to Coding Standards: 2 CVEs (1.2%) — click to drill down Incorrect Calculation: 1 CVEs (0.6%) — click to drill down Incorrect Comparison: 1 CVEs (0.6%) — click to drill down Total 146
Improper Control of a Resource Through its Lifetime CWE-664 88 (54.0%) Improper Neutralization CWE-707 26 (16.0%) Improper Access Control CWE-284 20 (12.3%) Protection Mechanism Failure CWE-693 8 (4.9%) Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435 7 (4.3%) Insufficient Control Flow Management CWE-691 7 (4.3%) Improper Check or Handling of Exceptional Conditions CWE-703 3 (1.8%) Improper Adherence to Coding Standards CWE-710 2 (1.2%) Incorrect Calculation CWE-682 1 (0.6%) Incorrect Comparison CWE-697 1 (0.6%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Boruta accepts expired JWT client assertions due to missing exp claim validation
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Boruta dynamic client registration allows creation of over-privileged OAuth clients
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-65635 2026-07-30
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-54885 2026-07-30
Insufficient verification of Hex package metadata in Gleam
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-59247 2026-07-29
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
pkg:hex/cowboy
pkg:github/ninenines/cowboy
CVE-2026-65624 2026-07-28
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
pkg:hex/cowlib
pkg:github/ninenines/cowlib
CVE-2026-59248 2026-07-28
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-54890 2026-07-27
Denial of service via exponential certificate policy tree growth in path validation
pkg:otp/public_key
pkg:github/erlang/otp
CVE-2026-59251 2026-07-27
Megaco flex scanner buffer overflow via oversized property parm name
pkg:otp/megaco
pkg:github/erlang/otp
CVE-2026-59250 2026-07-27
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-55953 2026-07-27
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-55737 2026-07-27
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
pkg:otp/stdlib
pkg:github/erlang/otp
CVE-2026-47078 2026-07-27
epmd permanent DoS via EMFILE on accept(2) in erts
pkg:otp/erts
pkg:github/erlang/otp
CVE-2026-42792 2026-07-27
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-58227 2026-07-27
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
pkg:hex/bandit
pkg:github/mtrudel/bandit
CVE-2026-65623 2026-07-24
Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
pkg:hex/mpp
pkg:github/zenhive/mpp
CVE-2026-59252 2026-07-17
Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
pkg:hex/mpp
pkg:github/zenhive/mpp
CVE-2026-59694 2026-07-17
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
pkg:hex/mpp
pkg:github/zenhive/mpp
CVE-2026-59695 2026-07-17
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-59249 2026-07-16
Missing ID token claim validation in ueberauth_apple allows account takeover
pkg:hex/ueberauth_apple
pkg:github/ueberauth/ueberauth_apple
CVE-2026-55954 2026-07-14
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-59246 2026-07-14
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
pkg:hex/mint
pkg:github/elixir-mint/mint
CVE-2026-58229 2026-07-14
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
pkg:hex/phoenix_live_view
pkg:github/phoenixframework/phoenix_live_view
CVE-2026-58228 2026-07-13
Cookie attribute injection in Plug.Conn.Cookies.encode/2
pkg:hex/plug
pkg:github/elixir-plug/plug
CVE-2026-56813 2026-07-10
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
pkg:hex/plug
pkg:github/elixir-plug/plug
CVE-2026-56814 2026-07-10
25 per page · 146 CVEs
Page of 6