agentprime: erlang-otpEvery new CVE for erlang-otp.https://agentprime.io/CVE-2026-105236: TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundarieshttps://agentprime.io/advisories/CVE-2026-105236/https://agentprime.io/advisories/CVE-2026-105236/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 16:55:51 GMTCVECVE-2026-94200: TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in sslhttps://agentprime.io/advisories/CVE-2026-94200/https://agentprime.io/advisories/CVE-2026-94200/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 16:55:23 GMTCVECVE-2026-65634: Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoderhttps://agentprime.io/advisories/CVE-2026-65634/https://agentprime.io/advisories/CVE-2026-65634/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 08:49:24 GMTCVECVE-2026-68956: SSH daemon allocates unbounded idle session channels, bypassing max_channelshttps://agentprime.io/advisories/CVE-2026-68956/https://agentprime.io/advisories/CVE-2026-68956/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 08:49:21 GMTCVECVE-2026-89422: TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extensionhttps://agentprime.io/advisories/CVE-2026-89422/https://agentprime.io/advisories/CVE-2026-89422/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 08:49:16 GMTCVEcriticalCVE-2026-69664: httpd parks a request worker indefinitely on a malformed chunk size sent after the headershttps://agentprime.io/advisories/CVE-2026-69664/https://agentprime.io/advisories/CVE-2026-69664/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:59:03 GMTCVECVE-2026-70409: eldap does not bound the port component of a referral URL before integer conversionhttps://agentprime.io/advisories/CVE-2026-70409/https://agentprime.io/advisories/CVE-2026-70409/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:51:00 GMTCVECVE-2026-70405: snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fieldshttps://agentprime.io/advisories/CVE-2026-70405/https://agentprime.io/advisories/CVE-2026-70405/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:50:34 GMTCVECVE-2026-66835: httpd mod_auth directory protection bypassed by a doubled slash in the request pathhttps://agentprime.io/advisories/CVE-2026-66835/https://agentprime.io/advisories/CVE-2026-66835/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:49:47 GMTCVECVE-2026-73270: httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemshttps://agentprime.io/advisories/CVE-2026-73270/https://agentprime.io/advisories/CVE-2026-73270/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:48:53 GMTCVECVE-2026-75538: A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peerhttps://agentprime.io/advisories/CVE-2026-75538/https://agentprime.io/advisories/CVE-2026-75538/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:48:26 GMTCVECVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authhttps://agentprime.io/advisories/CVE-2026-74994/https://agentprime.io/advisories/CVE-2026-74994/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:45:57 GMTCVECVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Receptionhttps://agentprime.io/advisories/CVE-2026-74835/https://agentprime.io/advisories/CVE-2026-74835/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:45:16 GMTCVECVE-2026-73812: inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Lengthhttps://agentprime.io/advisories/CVE-2026-73812/https://agentprime.io/advisories/CVE-2026-73812/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:42:42 GMTCVECVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping ihttps://agentprime.io/advisories/CVE-2026-73276/https://agentprime.io/advisories/CVE-2026-73276/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:41:24 GMTCVECVE-2026-66357: inets,httpd:HTTP Request Smuggling via obs-fold Header Continuationhttps://agentprime.io/advisories/CVE-2026-66357/https://agentprime.io/advisories/CVE-2026-66357/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:40:50 GMTCVECVE-2026-59696: uri_string does not bound the port component of a URI before integer conversionhttps://agentprime.io/advisories/CVE-2026-59696/https://agentprime.io/advisories/CVE-2026-59696/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:37:33 GMTCVECVE-2026-55951: httpc memory exhaustion via unbounded response header accumulationhttps://agentprime.io/advisories/CVE-2026-55951/https://agentprime.io/advisories/CVE-2026-55951/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:37:02 GMTCVECVE-2026-71380: httpd applies no timeout while receiving a request body, parking a worker on a stalled clienthttps://agentprime.io/advisories/CVE-2026-71380/https://agentprime.io/advisories/CVE-2026-71380/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:35:31 GMTCVECVE-2026-71562: httpc does not bound server-supplied numeric header values before integer conversionhttps://agentprime.io/advisories/CVE-2026-71562/https://agentprime.io/advisories/CVE-2026-71562/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:33:41 GMTCVECVE-2026-70399: httpd does not enforce the documented default max_clients connection limithttps://agentprime.io/advisories/CVE-2026-70399/https://agentprime.io/advisories/CVE-2026-70399/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 14:33:05 GMTCVECVE-2026-54890: BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decodinghttps://agentprime.io/advisories/CVE-2026-54890/https://agentprime.io/advisories/CVE-2026-54890/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:39:03 GMTCVECVE-2026-59251: Denial of service via exponential certificate policy tree growth in path validationhttps://agentprime.io/advisories/CVE-2026-59251/https://agentprime.io/advisories/CVE-2026-59251/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:30:47 GMTCVECVE-2026-59250: Megaco flex scanner buffer overflow via oversized property parm namehttps://agentprime.io/advisories/CVE-2026-59250/https://agentprime.io/advisories/CVE-2026-59250/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:25:03 GMTCVECVE-2026-55953: TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authenticationhttps://agentprime.io/advisories/CVE-2026-55953/https://agentprime.io/advisories/CVE-2026-55953/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:21:29 GMTCVEcriticalCVE-2026-55737: Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoderhttps://agentprime.io/advisories/CVE-2026-55737/https://agentprime.io/advisories/CVE-2026-55737/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:13:54 GMTCVECVE-2026-47078: Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypasshttps://agentprime.io/advisories/CVE-2026-47078/https://agentprime.io/advisories/CVE-2026-47078/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 15:03:50 GMTCVECVE-2026-42792: epmd permanent DoS via EMFILE on accept(2) in ertshttps://agentprime.io/advisories/CVE-2026-42792/https://agentprime.io/advisories/CVE-2026-42792/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 14:58:24 GMTCVECVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chainhttps://agentprime.io/advisories/CVE-2026-58227/https://agentprime.io/advisories/CVE-2026-58227/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 14:39:44 GMTCVECVE-2026-54891: Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in sslhttps://agentprime.io/advisories/CVE-2026-54891/https://agentprime.io/advisories/CVE-2026-54891/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:30 GMTCVECVE-2026-55950: DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessionshttps://agentprime.io/advisories/CVE-2026-55950/https://agentprime.io/advisories/CVE-2026-55950/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:24 GMTCVECVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loophttps://agentprime.io/advisories/CVE-2026-54886/https://agentprime.io/advisories/CVE-2026-54886/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:20 GMTCVECVE-2026-55952: TLS 1.3 server denial of service via malformed ClientHello pre-shared key extensionhttps://agentprime.io/advisories/CVE-2026-55952/https://agentprime.io/advisories/CVE-2026-55952/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:08 GMTCVECVE-2026-54887: DTLS server cookie bypass during startup window due to empty initial cookie secrethttps://agentprime.io/advisories/CVE-2026-54887/https://agentprime.io/advisories/CVE-2026-54887/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:04 GMTCVECVE-2026-53422: SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured roothttps://agentprime.io/advisories/CVE-2026-53422/https://agentprime.io/advisories/CVE-2026-53422/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 16:06:03 GMTCVECVE-2026-48856: httpc leaks Authorization header to cross-origin redirect targetshttps://agentprime.io/advisories/CVE-2026-48856/https://agentprime.io/advisories/CVE-2026-48856/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:41:51 GMTCVECVE-2026-48860: Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_disthttps://agentprime.io/advisories/CVE-2026-48860/https://agentprime.io/advisories/CVE-2026-48860/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:49 GMTCVECVE-2026-48855: SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configuredhttps://agentprime.io/advisories/CVE-2026-48855/https://agentprime.io/advisories/CVE-2026-48855/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:49 GMTCVECVE-2026-48858: ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attackshttps://agentprime.io/advisories/CVE-2026-48858/https://agentprime.io/advisories/CVE-2026-48858/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:45 GMTCVECVE-2026-48859: SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumerationhttps://agentprime.io/advisories/CVE-2026-48859/https://agentprime.io/advisories/CVE-2026-48859/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:43 GMTCVECVE-2026-49759: Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crashhttps://agentprime.io/advisories/CVE-2026-49759/https://agentprime.io/advisories/CVE-2026-49759/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:38 GMTCVECVE-2026-49760: Stack Buffer Overflow in ei_s_print_term at Very Large Integerhttps://agentprime.io/advisories/CVE-2026-49760/https://agentprime.io/advisories/CVE-2026-49760/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 14:35:36 GMTCVECVE-2026-42790: nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verificationhttps://agentprime.io/advisories/CVE-2026-42790/https://agentprime.io/advisories/CVE-2026-42790/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 15:09:01 GMTCVECVE-2026-42791: OCSP responder certificate validity period not checked in public_keyhttps://agentprime.io/advisories/CVE-2026-42791/https://agentprime.io/advisories/CVE-2026-42791/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 12:23:13 GMTCVECVE-2026-42789: Non-CA certificate accepted as intermediate issuer in public_key path validationhttps://agentprime.io/advisories/CVE-2026-42789/https://agentprime.io/advisories/CVE-2026-42789/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 12:23:06 GMTCVECVE-2026-32147: SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAThttps://agentprime.io/advisories/CVE-2026-32147/https://agentprime.io/advisories/CVE-2026-32147/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 12:01:20 GMTCVECVE-2026-28808: ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)https://agentprime.io/advisories/CVE-2026-28808/https://agentprime.io/advisories/CVE-2026-28808/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 12:28:16 GMTCVECVE-2026-32144: OCSP designated-responder authorization bypass via missing signature verificationhttps://agentprime.io/advisories/CVE-2026-32144/https://agentprime.io/advisories/CVE-2026-32144/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 12:28:00 GMTCVECVE-2026-28810: Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolverhttps://agentprime.io/advisories/CVE-2026-28810/https://agentprime.io/advisories/CVE-2026-28810/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 07:50:11 GMTCVECVE-2026-23941: Request smuggling via first-wins Content-Length parsing in inets httpdhttps://agentprime.io/advisories/CVE-2026-23941/https://agentprime.io/advisories/CVE-2026-23941/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 13 Mar 2026 09:11:58 GMTCVE