Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435 CWE-435 at MITRE
An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
CVEs
CVEs for Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections | CVE-2026-59249 | 2026-07-16 | |
| HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 | CVE-2026-43966 | 2026-06-08 | |
| CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection | CVE-2026-48596 | 2026-06-02 | |
| HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing | CVE-2026-49753 | 2026-06-02 | |
| SSRF allowlist bypass via percent-encoded host in hackney | CVE-2026-47076 | 2026-05-25 | |
| CL.CL HTTP request smuggling via duplicate Content-Length in bandit | CVE-2026-39805 | 2026-05-01 | |
| Request smuggling via first-wins Content-Length parsing in inets httpd |
pkg:otp/inets
|
CVE-2026-23941 | 2026-03-13 |