Erlang OTP eldap eldap:parse_port input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Erlang OTP. Affected by this issue is the function eldap:parse_port of the component eldap. Such manipulation leads to input validation. This vulnerability is documented as CVE-2026-70409. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Erlang OTP (affected version unknown) and classified as problematic. Affected by this issue is the function eldap:parse_port of the component eldap. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-70409 since 08/09/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

Applying the patch 1.2.14.2/1.2.16.1/1.3.1 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Erlang

Name

• OTP

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion