CVE-2026-28810 Erlang CVE debrief

Who should care

Organizations using Erlang/OTP versions 17.0 through 28.4.1, 27.3.4.9, and 26.2.5.18 should be aware of this vulnerability. This includes users of the built-in DNS resolver (inet_res) in trusted network environments and with trusted recursive resolvers.

Technical summary

The built-in DNS resolver (inet_res) in Erlang/OTP uses a sequential, process-global 16-bit transaction ID for UDP queries and lacks source port randomization. This makes DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. The vulnerability conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, potentially leading users to deploy the resolver in environments where spoofed DNS responses are possible.

Defensive priority

Medium priority should be given to patching this vulnerability, as it allows for DNS cache poisoning, which can have significant impacts on network security.

Recommended defensive actions

• Apply patches from OTP 28.4.2, OTP 27.3.4.10, or OTP 26.2.5.19
• Use a trusted recursive resolver
• Limit exposure to untrusted networks
• Monitor DNS queries and responses for suspicious activity
• Implement additional security measures such as DNS query validation

Evidence notes

The CVE record was published on 2026-04-07T09:16:20.473Z and was last modified on 2026-07-24T15:17:15.283Z. The NVD entry is currently Modified. This vulnerability affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11. Users should verify their deployments and apply patches or mitigations accordingly. Evidence is limited to public CVE and NVD information.

Official resources