CVE-2026-70405: CWE-1284 Improper Validation of Specified Quantity in Input in Erlang OTP

The vulnerability arises because the function snmp_pdus:dec_integer_notag/1 uses an unbounded size limit when decoding BER INTEGER values in SNMP messages. This causes the decoding process to perform superlinear work on large declared lengths due to recursive bitwise operations on increasingly large bignums. While a size-limited variant exists, it is only used in limited contexts. As a result, an attacker can send a crafted SNMP message with an excessively large length field, causing resource exhaustion before the PDU is processed. Affected versions include OTP from 17.0 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6, corresponding to SNMP versions 4.25.1 up to but not including 5.18.2.1, 5.19 up to but not including 5.20.2.2, and 5.20.3 up to but not including 5.20.5. Whether versions before OTP 17.0 are affected is unknown.

An unauthenticated remote attacker can degrade the availability of the affected system by sending a specially crafted SNMP message that triggers excessive CPU and memory consumption during BER INTEGER decoding. This can lead to denial of service conditions due to resource exhaustion. There is no indication of data confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch links or vendor advisories are provided, users should monitor Erlang/OTP official channels for updates addressing this vulnerability. Until a fix is available, consider restricting SNMP access to trusted sources or disabling SNMP if not required to reduce exposure.