# CVE-2026-70409: Erlang/OTP eldap unbound port integer conversion denial of service

Source: https://junglewise.ai/threats/cve-2026-70409-erlang-otp-eldap-unbound-port-integer-conversion-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70409 · Severity: info · CVSS 6.3 · Published 2026-09-01

Erlang/OTP's eldap library, used for LDAP directory service integration, contains a flaw in parsing LDAP referral URLs. A malicious or compromised LDAP server can craft a referral with an extremely long port number that causes the application to spend hundreds of milliseconds performing arbitrary-precision arithmetic, degrading availability. The attack requires an application to process server-supplied referral URLs, which is not done automatically by eldap itself.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-70409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70409 being exploited in the wild.

**How severe is CVE-2026-70409?** Informational severity, with a CVSS score of 6.3, published 1 September 2026.

**Which products and versions are affected?** Erlang Eldap 1.0.3 before 1.2.14.2, 1.2.15 before 1.2.16.1, 1.3 before 1.3.1; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.

**Is there a fix for CVE-2026-70409?** A patch was published on 2026-09-01: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70409 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70409?** Check whether you run Erlang Eldap or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw (CWE-1284) in the eldap:parse_port/2 function, which passes the port substring directly to list_to_integer/1 without length bounds. Although list_to_integer/1 is documented to accept integers of any size, a syntactically valid port consisting of up to roughly 1.26 million digits will successfully convert and consume hundreds of milliseconds per referral due to arbitrary-precision arithmetic. The surrounding try-catch only rejects parsing failures, not oversized inputs. Attack vector is network-based; an attacker must compromise or control an LDAP server that the application queries. Exploitation requires the application to explicitly pass a server-supplied referral string to eldap:parse_ldap_url/1, since eldap does not parse referrals automatically. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

## Affected products

- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang eldap 1.0.3 before 1.2.14.2, 1.2.15 before 1.2.16.1, 1.3 before 1.3.1

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-70409.html](https://cna.erlef.org/cves/CVE-2026-70409.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)