CVE-2026-70409

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5

Description Improper validation of input quantity in the eldap module allows a malicious or compromised LDAP server to degrade availability. The issue occurs when the server returns a referral URL containing a port component consisting of an excessively long sequence of digits. The function parse port/2 passes the port substring to list to integer/1 without a length bound. Because the conversion function accepts integers of any size, a syntactically valid port of up to approximately 1.26 million digits can be processed, consuming significant CPU resources through arbitrary-precision arithmetic. This flaw is triggered when an application passes a server-supplied referral to the parse ldap url/1 function.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later.