CVE-2026-70409
Received Received - Intake

Integer Overflow in Erlang/OTP eldap

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse_port/2 passes the port substring straight to list_to_integer/1 with no length bound. The surrounding try ... catch only rejects a value that fails to parse, so a syntactically valid port of up to roughly 1.26 million digits converts successfully and costs the caller hundreds of milliseconds of arbitrary-precision arithmetic per referral. The conversion function itself is documented to accept integers of any size, so bounding the input is the caller's responsibility. Reaching the flaw requires the application to pass a server-supplied referral to eldap:parse_ldap_url/1, which eldap never calls itself: referral strings are returned to the caller unparsed. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to eldap from 1.0.3 before 1.2.14.2, from 1.2.15 before 1.2.16.1, and from 1.3 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-70409
EUVD
EUVD-2026-69247

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
erlang otp to 27.3.4.17 (exc)
erlang otp to 28.5.0.6 (exc)
erlang otp to 29.0.6 (exc)
erlang eldap to 1.2.14.2 (exc)
erlang eldap to 1.2.16.1 (exc)
erlang eldap to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70409 is an improper input validation flaw in Erlang/OTP's eldap library. A malicious LDAP server can return a referral URL with an extremely long port number (up to 1.26 million digits). The eldap:parse_port/2 function converts this port to an integer without length checks, causing the system to perform resource-intensive arbitrary-precision arithmetic. This consumes significant CPU time and degrades system availability.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage or slow responses when processing LDAP referrals. Check if your Erlang/OTP eldap library versions are outdated. Use commands like 'erl -version' to verify OTP versions and 'application:which_applications()' in an Erlang shell to check eldap versions.

Impact Analysis

This vulnerability can lead to Denial-of-Service (DoS) by consuming excessive CPU resources. Attackers can craft large port numbers to slow down or crash systems using the eldap library. Systems processing untrusted LDAP referrals are particularly at risk. The impact is limited to availability, as no data is directly exposed or modified.

Mitigation Strategies

Immediately upgrade to patched versions: OTP 27.3.4.17, 28.5.0.6, or 29.0.6, and eldap versions 1.2.14.2, 1.2.16.1, or 1.3.1. If upgrading is not possible, restrict network access to LDAP servers or implement input validation for referral URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart