Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Protection Mechanism Failure CWE-693 CWE-693 at MITRE

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Insufficient Verification of Data Authenticity: 4 CVEs (50.0%) — click to drill down Use of Insufficiently Random Values: 1 CVEs (12.5%) — click to drill down Improper Isolation or Compartmentalization: 1 CVEs (12.5%) — click to drill down Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'): 1 CVEs (12.5%) — click to drill down Reliance on Untrusted Inputs in a Security Decision: 1 CVEs (12.5%) — click to drill down Incomplete List of Disallowed Inputs: 0 CVEs (0.0%) — click to drill down Missing Encryption of Sensitive Data: 0 CVEs (0.0%) — click to drill down Inadequate Encryption Strength: 0 CVEs (0.0%) — click to drill down Use of a Broken or Risky Cryptographic Algorithm: 0 CVEs (0.0%) — click to drill down Insufficient UI Warning of Dangerous Operations: 0 CVEs (0.0%) — click to drill down Improperly Implemented Security Check for Standard: 0 CVEs (0.0%) — click to drill down Improper Protection of Alternate Path: 0 CVEs (0.0%) — click to drill down Client-Side Enforcement of Server-Side Security: 0 CVEs (0.0%) — click to drill down Reliance on a Single Factor in a Security Decision: 0 CVEs (0.0%) — click to drill down Insufficient Psychological Acceptability: 0 CVEs (0.0%) — click to drill down Reliance on Security Through Obscurity: 0 CVEs (0.0%) — click to drill down Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism: 0 CVEs (0.0%) — click to drill down Semiconductor Defects in Hardware Logic with Security-Sensitive Implications: 0 CVEs (0.0%) — click to drill down Incorrect Selection of Fuse Values: 0 CVEs (0.0%) — click to drill down Product Released in Non-Release Configuration: 0 CVEs (0.0%) — click to drill down Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques: 0 CVEs (0.0%) — click to drill down Public Key Re-Use for Signing both Debug and Production Code: 0 CVEs (0.0%) — click to drill down Missing Support for Security Features in On-chip Fabrics or Buses: 0 CVEs (0.0%) — click to drill down Improper Protection against Electromagnetic Fault Injection (EM-FI): 0 CVEs (0.0%) — click to drill down Missing Immutable Root of Trust in Hardware: 0 CVEs (0.0%) — click to drill down Improper Protections Against Hardware Overheating: 0 CVEs (0.0%) — click to drill down Total 8
Insufficient Verification of Data Authenticity CWE-345 4 (50.0%) Use of Insufficiently Random Values CWE-330 1 (12.5%) Improper Isolation or Compartmentalization CWE-653 1 (12.5%) Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') CWE-757 1 (12.5%) Reliance on Untrusted Inputs in a Security Decision CWE-807 1 (12.5%) Incomplete List of Disallowed Inputs CWE-184 0 (0.0%) Missing Encryption of Sensitive Data CWE-311 0 (0.0%) Inadequate Encryption Strength CWE-326 0 (0.0%) Use of a Broken or Risky Cryptographic Algorithm CWE-327 0 (0.0%) Insufficient UI Warning of Dangerous Operations CWE-357 0 (0.0%) Improperly Implemented Security Check for Standard CWE-358 0 (0.0%) Improper Protection of Alternate Path CWE-424 0 (0.0%) Client-Side Enforcement of Server-Side Security CWE-602 0 (0.0%) Reliance on a Single Factor in a Security Decision CWE-654 0 (0.0%) Insufficient Psychological Acceptability CWE-655 0 (0.0%) Reliance on Security Through Obscurity CWE-656 0 (0.0%) Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism CWE-1039 0 (0.0%) Semiconductor Defects in Hardware Logic with Security-Sensitive Implications CWE-1248 0 (0.0%) Incorrect Selection of Fuse Values CWE-1253 0 (0.0%) Product Released in Non-Release Configuration CWE-1269 0 (0.0%) Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques CWE-1278 0 (0.0%) Public Key Re-Use for Signing both Debug and Production Code CWE-1291 0 (0.0%) Missing Support for Security Features in On-chip Fabrics or Buses CWE-1318 0 (0.0%) Improper Protection against Electromagnetic Fault Injection (EM-FI) CWE-1319 0 (0.0%) Missing Immutable Root of Trust in Hardware CWE-1326 0 (0.0%) Improper Protections Against Hardware Overheating CWE-1338 0 (0.0%)

CVEs

CVEs for Protection Mechanism Failure CWE-693

Summary Publication CVE ID Published
Boruta dynamic client registration allows creation of over-privileged OAuth clients
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-65635 2026-07-30
Insufficient verification of Hex package metadata in Gleam
pkg:sid/gleam.run/gleam
pkg:github/gleam-lang/gleam
pkg:oci/gleam
CVE-2026-59247 2026-07-29
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-55953 2026-07-27
Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-54891 2026-07-02
gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
pkg:hex/gun
pkg:github/ninenines/gun
CVE-2026-43972 2026-06-08
Client-supplied URI scheme trusted without transport verification in bandit
pkg:hex/bandit
pkg:github/mtrudel/bandit
CVE-2026-39807 2026-05-01
Lockfile checksums not verified in Hex allows dependency integrity bypass
pkg:otp/hex
pkg:github/hexpm/hex
CVE-2026-32148 2026-04-30
Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
pkg:otp/kernel
pkg:github/erlang/otp
CVE-2026-28810 2026-04-07
8 CVEs