https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:41:19.767491+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07216 bdu:2026-07216 2026-10-03T18:41:19.779212+00:00 bdu:2026-07216 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0321 certfr-2026-avi-0321 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-03T18:41:19.779278+00:00 certfr-2026-avi-0321 https://cve.radiocsirt.org/vuln/euvd-2026-340592 EUVD-2026-340592 2026-10-03T18:41:19.779321+00:00 EUVD-2026-340592 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23943 fkie_cve-2026-23943 2026-10-03T18:41:19.779334+00:00

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.

Two compression algorithms are affected:

* zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com: Activates post-authentication, enabling authenticated attacks

Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.

This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.

This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-23943 msrc_CVE-2026-23943 — Pre-auth SSH DoS via unbounded zlib inflate 2026-10-03T18:41:19.779374+00:00 msrc_CVE-2026-23943 https://cve.radiocsirt.org/vuln/oesa-2026-1665 OESA-2026-1665 — erlang security update 2026-10-03T18:41:19.779391+00:00

Affected: openEuler:24.03-LTS-SP2: erlang

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper p…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10947-1 openSUSE-SU-2026:10947-1 — erlang27-27.1.3-2.1 on GA media 2026-10-03T18:41:19.779435+00:00

erlang27-27.1.3-2.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:21374-1 SUSE-SU-2026:21374-1 — Security update for erlang 2026-10-03T18:41:19.779455+00:00

Security update for erlang

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23943 UBUNTU-CVE-2026-23943 2026-10-03T18:41:19.779472+00:00

Affected: Ubuntu:Pro:14.04:LTS: erlang, Ubuntu:Pro:16.04:LTS: erlang, Ubuntu:Pro:18.04:LTS: erlang, Ubuntu:Pro:20.04:LTS: erlang, Ubuntu:22.04:LTS: erlang, Ubuntu:24.04:LTS: erlang, Ubuntu:25.10: erlang, Ubuntu:26.04:LTS: erlang

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com: Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0721 WID-SEC-W-2026-0721 — Erlang/OTP: Mehrere Schwachstellen 2026-10-03T18:41:19.779508+00:00

Ein Angreifer kann mehrere Schwachstellen in Erlang/OTP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder HTTP-Request-Smuggling zu erreichen, was weitere Angriffe ermöglicht.