CVE-2026-70405

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 snmp versions 4.25.1 through 5.18.2.0 snmp versions 5.19 through 5.20.2.1 snmp versions 5.20.3 through 5.20.4

Description Improper validation of the specified quantity in input within the snmp module allows a remote attacker to degrade availability. An attacker can send an SNMP message containing a BER INTEGER with an arbitrarily large length field. The function snmp pdus:dec integer notag/1 defaults its size limit to infinity, and do dec integer notag/2 accumulates the value across every declared byte using a recursive shift and bitwise or. This causes the workload to grow superlinearly as each operation acts on a progressively larger bignum. While a size-limited variant dec integer notag/2 exists, it is only used by dec snmp version/1. Other fields, including the request identifier, error status, index, generic and specific trap fields, engine boots, time, and varbind values decoded by dec value/1, use the unbounded form. The decoding occurs before the PDU is processed, meaning no valid request is required to trigger the issue.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Update snmp to version 5.18.2.1 or later. Update snmp to version 5.20.2.2 or later. Update snmp to version 5.20.5 or later.