CVE-2026-70409 Erlang CVE debrief

Who should care

Defenders responsible for systems that interact with untrusted LDAP servers, especially those using Erlang/OTP, should assess exposure and take mitigation steps. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize patching or mitigating this vulnerability to prevent potential DoS conditions and performance degradation.

Why it matters

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that interact with untrusted LDAP servers, to prevent potential DoS conditions and performance degradation.

• Potential denial-of-service (DoS) condition due to excessive CPU usage
• Performance degradation in systems that interact with untrusted LDAP servers

Technical summary

The eldap module in Erlang/OTP is vulnerable to a DoS condition due to improper validation of the port component in referral URLs returned by LDAP servers. This can lead to excessive CPU usage during the parsing of large port numbers. The vulnerability affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1. Defenders should prioritize patching or mitigating this vulnerability, especially in systems that interact with untrusted LDAP servers.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that interact with untrusted LDAP servers.

Recommended defensive actions

• Assess exposure and apply patches or updates to affected OTP versions
• Implement input validation and sanitization for LDAP referrals
• Monitor systems for unusual activity or performance issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by improper validation of the port component in referral URLs returned by LDAP servers. This can lead to a DoS condition due to excessive CPU usage during the parsing of large port numbers. The eldap module in Erlang/OTP is vulnerable, affecting OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6. The issue requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.