Quick answers
- Is CVE-2026-70405 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-70405 being exploited in the wild.
- How severe is CVE-2026-70405?
- Informational severity, with a CVSS score of 6.3, published 1 September 2026.
- Which products and versions are affected?
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6; Erlang Snmp 4.25.1 before 5.18.2.1, 5.19 before 5.20.2.2, 5.20.3 before 5.20.5.
- Is there a fix for CVE-2026-70405?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-70405 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-70405?
- Check whether you run Erlang OTP or Erlang Snmp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper input validation flaw (CWE-1284) in the BER INTEGER decoder of Erlang/OTP's SNMP library. The function snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, allowing arbitrarily large length fields in BER-encoded integers. The vulnerable do_dec_integer_notag/2 function then accumulates the integer value through recursive bit shifts and bitwise operations on progressively larger bignums, resulting in superlinear CPU consumption based on the declared length. The decode occurs before PDU validation, so no authentication or valid SNMP request structure is required—the attacker only needs network reachability to the SNMP service to send a malicious message. A remote, unauthenticated attacker can trigger severe CPU and memory exhaustion, causing denial of service. Patches are available in OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later, and in snmp 5.18.2.1, 5.20.2.2, and 5.20.5 and later.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang snmp 4.25.1 before 5.18.2.1, 5.19 before 5.20.2.2, 5.20.3 before 5.20.5
Timeline
- 2026-09-01: disclosed
- 2026-09-08: advisory: CVE details published and updated