CVE-2026-28808 Erlang CVE debrief

Who should care

This vulnerability affects users of Erlang OTP, particularly those using the inets modules. System administrators and developers who use Erlang OTP for web applications should be aware of this issue and take necessary actions to protect their systems. The vulnerability's high severity score of 8.3 indicates that it is a critical issue that requires immediate attention.

Technical summary

The vulnerability is caused by a path mismatch between mod_auth and mod_cgi when script_alias maps a URL prefix to a directory outside DocumentRoot. Specifically, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path, while mod_cgi executes the script at the ScriptAlias-resolved path. This discrepancy allows unauthenticated access to CGI scripts that directory rules were meant to protect. The affected program files are lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

Defensive priority

This vulnerability has a high severity score of 8.3, indicating that it is a critical issue that requires immediate attention. System administrators and developers should prioritize patching this vulnerability to prevent potential attacks.

Recommended defensive actions

• Update to OTP 28.4.2 or later
• Update to OTP 27.3.4.10 or later
• Update to OTP 26.2.5.19 or later
• Update inets to 9.6.2 or later
• Update inets to 9.3.2.4 or later
• Update inets to 9.1.0.6 or later

Evidence notes

The CVE-2026-28808 vulnerability is documented in the official CVE record and NVD detail pages. The vulnerability affects multiple versions of Erlang OTP and inets. The CVSS score for this vulnerability is 8.3, indicating a high severity level.

Official resources