PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28810 Erlang CVE debrief

The CVE-2026-28810 vulnerability is a Generation of Predictable Numbers or Identifiers issue in the Erlang/OTP kernel, specifically in the inet_res and inet_db modules. This vulnerability allows for DNS cache poisoning due to the use of a sequential, process-global 16-bit transaction ID for UDP queries without source port randomization. The affected versions of OTP are from 17.0 before OTP 28.4.2, OTP 27.3.4.10, and OTP 26.2.5.19.

Vendor
Erlang
Product
OTP
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Organizations using Erlang/OTP versions 17.0 through 28.4.1, 27.3.4.9, and 26.2.5.18 should be aware of this vulnerability. This includes users of the built-in DNS resolver (inet_res) in trusted network environments and with trusted recursive resolvers.

Technical summary

The built-in DNS resolver (inet_res) in Erlang/OTP uses a sequential, process-global 16-bit transaction ID for UDP queries and lacks source port randomization. This makes DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. The vulnerability conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, potentially leading users to deploy the resolver in environments where spoofed DNS responses are possible.

Defensive priority

Medium priority should be given to patching this vulnerability, as it allows for DNS cache poisoning, which can have significant impacts on network security.

Recommended defensive actions

  • Apply patches from OTP 28.4.2, OTP 27.3.4.10, or OTP 26.2.5.19
  • Use a trusted recursive resolver
  • Limit exposure to untrusted networks
  • Monitor DNS queries and responses for suspicious activity
  • Implement additional security measures such as DNS query validation

Evidence notes

The CVE record was published on 2026-04-07T09:16:20.473Z and was last modified on 2026-07-24T15:17:15.283Z. The NVD entry is currently Modified. This vulnerability affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11. Users should verify their deployments and apply patches or mitigations accordingly. Evidence is limited to public CVE and NVD information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28810 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28810

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28810 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28810

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-28810.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Third Party Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Vendor Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-28810

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Third Party Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.erlang.org/doc/system/versions.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db - Release Notes

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.