Interpretation Conflict · Common Weaknesses

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Interpretation Conflict CWE-436 CWE-436 at MITRE

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE-444 4 (66.7%) Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') CWE-113 2 (33.3%) Improper Neutralization of Invalid Characters in Identifiers in Web Pages CWE-86 0 (0.0%) Misinterpretation of Input CWE-115 0 (0.0%) Incomplete Model of Endpoint Features CWE-437 0 (0.0%) Null Byte Interaction Error (Poison Null Byte) CWE-626 0 (0.0%) Trusting HTTP Permission Methods on the Server Side CWE-650 0 (0.0%)

CVEs

CVEs for Interpretation Conflict CWE-436

Summary	Publication	CVE ID	Published
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-59249	2026-07-16
HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2	`pkg:hex/cowlib` `pkg:github/ninenines/cowlib`	CVE-2026-43966	2026-06-08
CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection	`pkg:hex/tesla` `pkg:github/elixir-tesla/tesla`	CVE-2026-48596	2026-06-02
HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-49753	2026-06-02
SSRF allowlist bypass via percent-encoded host in hackney	`pkg:hex/hackney` `pkg:github/benoitc/hackney`	CVE-2026-47076	2026-05-25
CL.CL HTTP request smuggling via duplicate Content-Length in bandit	`pkg:hex/bandit` `pkg:github/mtrudel/bandit`	CVE-2026-39805	2026-05-01
Request smuggling via first-wins Content-Length parsing in inets httpd	`pkg:otp/inets` `pkg:github/erlang/otp`	CVE-2026-23941	2026-03-13

7 CVEs