Erlang OTP up to 28.4.2 inet_res/inet_db generation of predictable numbers or identifiers

Summaryinfo

A vulnerability identified as problematic has been detected in Erlang OTP up to 28.4.2. This vulnerability affects unknown code of the component inet_res/inet_db. The manipulation leads to generation of predictable numbers or identifiers. This vulnerability is documented as CVE-2026-28810. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Erlang OTP up to 28.4.2 and classified as problematic. This issue affects some unknown functionality of the component inet_res/inet_db. The manipulation with an unknown input leads to a generation of predictable numbers or identifiers vulnerability. Using CWE to declare the problem leads to CWE-340. The product uses a scheme that generates numbers or identifiers that are more predictable than required. Impacted is integrity. The summary by CVE is:

Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to kernel from 3.0 until 10.6.2, 10.2.7.4 and 9.2.4.11.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-28810 since 03/03/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/23/2026). MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 305613 (Linux Distros Unpatched Vulnerability : CVE-2026-28810), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (305613) and CERT Bund (WID-SEC-2026-0998). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• SUSE openSUSE
• Microsoft Azure Linux
• Open Source Erlang/OTP

Productinfo

Vendor

• Erlang

Name

• OTP

Version

• 9.2.4.0
• 9.2.4.1
• 9.2.4.2
• 9.2.4.3
• 9.2.4.4
• 9.2.4.5
• 9.2.4.6
• 9.2.4.7
• 9.2.4.8
• 9.2.4.9
• 9.2.4.10
• 9.2.4.11
• 10.2.7.0
• 10.2.7.1
• 10.2.7.2
• 10.2.7.3
• 10.2.7.4
• 10.6.0
• 10.6.1
• 10.6.2
• 17.0
• 26.2.5.0
• 26.2.5.1
• 26.2.5.2
• 26.2.5.3
• 26.2.5.4
• 26.2.5.5
• 26.2.5.6
• 26.2.5.7
• 26.2.5.8
• 26.2.5.9
• 26.2.5.10
• 26.2.5.11
• 26.2.5.12
• 26.2.5.13
• 26.2.5.14
• 26.2.5.15
• 26.2.5.16
• 26.2.5.17
• 26.2.5.18
• 26.2.5.19
• 27.3.4.0
• 27.3.4.1
• 27.3.4.2
• 27.3.4.3
• 27.3.4.4
• 27.3.4.5
• 27.3.4.6
• 27.3.4.7
• 27.3.4.8
• 27.3.4.9
• 27.3.4.10
• 28.4.0
• 28.4.1
• 28.4.2

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion