Improper Initialization · Common Weaknesses

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Initialization CWE-665 CWE-665 at MITRE

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Allocation of Resources Without Limits or Throttling CWE-770 35 (100.0%) Non-exit on Failed Initialization CWE-455 0 (0.0%) Use of Uninitialized Resource CWE-908 0 (0.0%) Missing Initialization of Resource CWE-909 0 (0.0%) Cryptographic Operations are run Before Supporting Units are Ready CWE-1279 0 (0.0%) Incorrect Initialization of Resource CWE-1419 0 (0.0%) Insecure Setting of Generative AI/ML Model Inference Parameters CWE-1434 0 (0.0%)

CVEs

CVEs for Improper Initialization CWE-665

Summary	Publication	CVE ID	Published
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion	`pkg:hex/cowboy` `pkg:github/ninenines/cowboy`	CVE-2026-65624	2026-07-28
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS	`pkg:hex/cowlib` `pkg:github/ninenines/cowlib`	CVE-2026-59248	2026-07-28
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding	`pkg:otp/erts` `pkg:github/erlang/otp`	CVE-2026-54890	2026-07-27
Denial of service via exponential certificate policy tree growth in path validation	`pkg:otp/public_key` `pkg:github/erlang/otp`	CVE-2026-59251	2026-07-27
epmd permanent DoS via EMFILE on accept(2) in erts	`pkg:otp/erts` `pkg:github/erlang/otp`	CVE-2026-42792	2026-07-27
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-59246	2026-07-14
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-58229	2026-07-14
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)	`pkg:hex/plug` `pkg:github/elixir-plug/plug`	CVE-2026-56814	2026-07-10
Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service	`pkg:hex/phoenix` `pkg:github/phoenixframework/phoenix`	CVE-2026-56811	2026-07-07
mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-56810	2026-07-06
Atom-table exhaustion denial-of-service via JSON parse_document in MDEx	`pkg:hex/mdex` `pkg:github/leandrocp/mdex`	CVE-2026-53426	2026-06-29
Unbounded memory allocation in highlight_lines range expansion in mdex	`pkg:hex/mdex` `pkg:github/leandrocp/mdex` `pkg:hex/mdex_native` `pkg:github/leandrocp/mdex_native`	CVE-2026-53428	2026-06-29
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc	`pkg:hex/grpc` `pkg:github/elixir-grpc/grpc`	CVE-2026-48853	2026-06-15
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc	`pkg:hex/grpc` `pkg:github/elixir-grpc/grpc`	CVE-2026-48854	2026-06-15
Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin	`pkg:hex/membrane_mp4_plugin` `pkg:github/membraneframework/membrane_mp4_plugin`	CVE-2026-53423	2026-06-11
gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion	`pkg:hex/gun` `pkg:github/ninenines/gun`	CVE-2026-43973	2026-06-08
Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint	`pkg:hex/tesla` `pkg:github/elixir-tesla/tesla`	CVE-2026-48597	2026-06-02
HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-49754	2026-06-02
Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency	`pkg:hex/mint` `pkg:github/elixir-mint/mint`	CVE-2026-48862	2026-06-02
Atom table exhaustion via unrecognized URL schemes in hackney	`pkg:hex/hackney` `pkg:github/benoitc/hackney`	CVE-2026-47067	2026-05-25
Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook	`pkg:hex/phoenix_storybook` `pkg:github/phenixdigital/phoenix_storybook`	CVE-2026-8469	2026-05-20
Unbounded buffer accumulation in multipart header parsing causes denial of service in plug	`pkg:hex/plug` `pkg:github/elixir-plug/plug`	CVE-2026-8468	2026-05-14
Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy	`pkg:hex/cowboy` `pkg:github/ninenines/cowboy`	CVE-2026-8466	2026-05-13
HTTP/1 chunked body reader ignores length cap in bandit	`pkg:hex/bandit` `pkg:github/mtrudel/bandit`	CVE-2026-39803	2026-05-13
Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe	`pkg:hex/absinthe` `pkg:github/absinthe-graphql/absinthe`	CVE-2026-42793	2026-05-08

25 per page · 35 CVEs