Vulnerability in Erlang Otp
CVE-2026-28810
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for U…
EPSS: 0.000 (14.8th percentile) — read the EPSS interpretation.
Affected products
- Erlang Otp — versions 3.0, 17.0, 07b8f441ca711f9812fad9e9115bab3c3aa92f79
Weakness classification (CWE)
References
- github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8 (vendor-advisory, related)
- cna.erlef.org/cves/CVE-2026-28810.html (related)
- osv.dev/vulnerability/EEF-CVE-2026-28810 (related)
- www.erlang.org/doc/system/versions.html (x_version-scheme)
- github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5 (patch)
- github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd (patch)
- github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8 (patch)