CVE-2026-70405 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP deployments, especially those using SNMP, should assess exposure and verify the need for updates or compensating controls. They should also monitor for potential availability degradation and prioritize remediation based on deployment context. This includes reviewing SNMP configurations, assessing the need for updates, and implementing compensating controls where necessary.

Why it matters

The CVE-2026-70405 vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability. Defenders should verify exposure, assess the need for updates or compensating controls, and monitor for potential availability degradation.

• Verify exposure in Erlang/OTP deployments using SNMP
• Assess the need for updates or compensating controls
• Monitor for potential availability degradation
• Prioritize remediation based on deployment context

Technical summary

The Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. The issue arises from the unbounded form dec_integer_notag/1 used in various decoding processes, which can lead to superlinear growth in work based on the declared length of the INTEGER. This affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6.

Defensive priority

Defenders should prioritize verifying exposure in Erlang/OTP deployments, especially those using SNMP, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Erlang/OTP version and assess exposure
• Review SNMP configuration and usage
• Consider updating to OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6
• Monitor for potential availability degradation
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp. The issue allows a remote attacker to degrade availability by sending an SNMP message with a large BER INTEGER length field.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.