PT-2026-30803 · Erlang Solutions · Erlang/Otp

Raimo Niskanen · Published 2026-04-07 · Updated 2026-04-22 · CVE-2026-28810

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 28.4.2, 27.3.4.10 and 26.2.5.19

Description A predictable number generation issue in the Erlang/OTP kernel's inet res and inet db modules allows for DNS cache poisoning. The built-in DNS resolver uses a sequential transaction ID for UDP queries and lacks source port randomization. Validation relies heavily on this ID, making it possible for an attacker to forge DNS responses if they can observe a query or predict the next ID. This is inconsistent with RFC 5452 recommendations. The inet res resolver is designed for trusted network environments and with trusted recursive resolvers. The affected program files are lib/kernel/src/inet db.erl and lib/kernel/src/inet res.erl.

Recommendations Install Erlang nodes in a trusted network protected from DNS reply spoofing by firewalls, and configure the inet res resolver to communicate only with trusted recursive name servers within that network.

Fix

Weakness Enumeration

CWE-340

Related Identifiers

CVE-2026-28810

GHSA-V884-5JG5-WHJ8

OPENSUSE-SU-2026:20607-1

Affected Products

Erlang/Otp

References · 30

• https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd · Patch
• https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8 · Patch
• https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8 · Vendor Advisory
• https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5 · Patch
• https://ubuntu.com/security/CVE-2026-28810 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28810 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20607-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28810 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-28810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28810 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28810 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28810 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-28810.html · Note
• https://suse.com/security/cve/CVE-2026-21620 · Note
• https://suse.com/security/cve/CVE-2026-32144 · Note