Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Asymmetric Resource Consumption (Amplification) CWE-405 CWE-405 at MITRE

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Improper Handling of Highly Compressed Data (Data Amplification): 5 CVEs (55.6%) — click to drill down Inefficient Algorithmic Complexity: 4 CVEs (44.4%) — click to drill down Insufficient Control of Network Message Volume (Network Amplification): 0 CVEs (0.0%) — click to drill down Incorrect Behavior Order: Early Amplification: 0 CVEs (0.0%) — click to drill down Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'): 0 CVEs (0.0%) — click to drill down Excessive Platform Resource Consumption within a Loop: 0 CVEs (0.0%) — click to drill down Data Resource Access without Use of Connection Pooling: 0 CVEs (0.0%) — click to drill down Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses: 0 CVEs (0.0%) — click to drill down Invokable Control Element with Excessive File or Data Access Operations: 0 CVEs (0.0%) — click to drill down Large Data Table with Excessive Number of Indices: 0 CVEs (0.0%) — click to drill down Excessive Index Range Scan for a Data Resource: 0 CVEs (0.0%) — click to drill down Inefficient CPU Computation: 0 CVEs (0.0%) — click to drill down Total 9
Improper Handling of Highly Compressed Data (Data Amplification) CWE-409 5 (55.6%) Inefficient Algorithmic Complexity CWE-407 4 (44.4%) Insufficient Control of Network Message Volume (Network Amplification) CWE-406 0 (0.0%) Incorrect Behavior Order: Early Amplification CWE-408 0 (0.0%) Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') CWE-776 0 (0.0%) Excessive Platform Resource Consumption within a Loop CWE-1050 0 (0.0%) Data Resource Access without Use of Connection Pooling CWE-1072 0 (0.0%) Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses CWE-1073 0 (0.0%) Invokable Control Element with Excessive File or Data Access Operations CWE-1084 0 (0.0%) Large Data Table with Excessive Number of Indices CWE-1089 0 (0.0%) Excessive Index Range Scan for a Data Resource CWE-1094 0 (0.0%) Inefficient CPU Computation CWE-1176 0 (0.0%)

CVEs

CVEs for Asymmetric Resource Consumption (Amplification) CWE-405

Summary Publication CVE ID Published
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
pkg:hex/bandit
pkg:github/mtrudel/bandit
CVE-2026-65623 2026-07-24
Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax
pkg:hex/hpax
pkg:github/elixir-mint/hpax
CVE-2026-58226 2026-07-06
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
pkg:hex/plug
pkg:github/elixir-plug/plug
CVE-2026-54892 2026-06-23
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
pkg:hex/grpc
pkg:github/elixir-grpc/grpc
CVE-2026-53430 2026-06-15
Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies
pkg:hex/req
pkg:github/wojtekmach/req
CVE-2026-49755 2026-06-08
Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression
pkg:hex/tesla
pkg:github/elixir-tesla/tesla
CVE-2026-48594 2026-06-02
Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame
pkg:hex/cowlib
pkg:github/ninenines/cowlib
CVE-2026-43970 2026-05-13
Quadratic fragment-name uniqueness check causes denial of service in absinthe
pkg:hex/absinthe
pkg:github/absinthe-graphql/absinthe
CVE-2026-43967 2026-05-08
Pre-auth SSH DoS via unbounded zlib inflate
pkg:otp/ssh
pkg:github/erlang/otp
CVE-2026-23943 2026-03-13
9 CVEs