CVE-2026-70409 Erlang CVE debrief

Who should care

Defenders of systems using Erlang/OTP, particularly those with LDAP interactions, should assess exposure and verify affected versions to prevent potential availability degradation from malicious LDAP servers. This includes reviewing and applying patches, monitoring LDAP server interactions, and verifying affected scope and severity.

Why it matters

Defenders of systems using Erlang/OTP should assess exposure and verify affected versions to prevent potential availability degradation from malicious LDAP servers.

• Potential performance degradation from parsing long port numbers in LDAP referral URLs
• Need to verify and update affected OTP versions to prevent availability issues
• Possible impact on systems with LDAP interactions using Erlang/OTP eldap

Technical summary

The eldap:parse_port/2 function in Erlang/OTP does not validate the length of the port substring when converting it to an integer, allowing a very long run of digits to cause performance issues. This can lead to potential availability degradation from malicious LDAP servers. The vulnerability affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1.

Defensive priority

Defenders should prioritize verifying and updating affected OTP versions to prevent potential availability degradation from malicious LDAP servers.

Recommended defensive actions

• Verify and update affected OTP versions to prevent potential availability degradation
• Review and apply patches from Erlang for OTP 17.0, 28.0, and 29.0
• Monitor LDAP server interactions for unusual referral URLs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Erlang/OTP eldap. Official sources include CVE Program, NIST National Vulnerability Database, and Erlang. The vulnerability was disclosed on 2026-09-01T15:17:24.427Z. The CVE record was published on the same date and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.