CVE-2026-70409: Erlang/OTP eldap unbound port integer conversion denial of service

CVE-2026-70409 · Severity: info · CVSS 6.3 · Published 2026-09-01

Erlang/OTP's eldap library, used for LDAP directory service integration, contains a flaw in parsing LDAP referral URLs. A malicious or compromised LDAP server can craft a referral with an extremely long port number that causes the application to spend hundreds of milliseconds performing arbitrary-precision arithmetic, degrading availability. The attack requires an application to process server-supplied referral URLs, which is not done automatically by eldap itself.

Technologies: Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-70409 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70409 being exploited in the wild.
How severe is CVE-2026-70409?
Informational severity, with a CVSS score of 6.3, published 1 September 2026.
Which products and versions are affected?
Erlang Eldap 1.0.3 before 1.2.14.2, 1.2.15 before 1.2.16.1, 1.3 before 1.3.1; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-70409?
A patch was published on 2026-09-01: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70409 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-70409?
Check whether you run Erlang Eldap or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation flaw (CWE-1284) in the eldap:parse_port/2 function, which passes the port substring directly to list_to_integer/1 without length bounds. Although list_to_integer/1 is documented to accept integers of any size, a syntactically valid port consisting of up to roughly 1.26 million digits will successfully convert and consume hundreds of milliseconds per referral due to arbitrary-precision arithmetic. The surrounding try-catch only rejects parsing failures, not oversized inputs. Attack vector is network-based; an attacker must compromise or control an LDAP server that the application queries. Exploitation requires the application to explicitly pass a server-supplied referral string to eldap:parse_ldap_url/1, since eldap does not parse referrals automatically. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

Affected products

  • Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang eldap 1.0.3 before 1.2.14.2, 1.2.15 before 1.2.16.1, 1.3 before 1.3.1

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.