CVE-2026-70409: CWE-1284 Improper Validation of Specified Quantity in Input in Erlang OTP

The vulnerability arises from eldap:parse_port/2 in Erlang/OTP eldap module, which converts the port substring from an LDAP referral URL to an integer without bounding its length. The function list_to_integer/1 accepts arbitrarily large integers, so a very long numeric port string (up to about 1.26 million digits) can be parsed successfully but causes significant CPU consumption due to arbitrary-precision arithmetic. This leads to a denial-of-service condition by degrading availability. The vulnerability affects OTP versions >=17.0 <27.3.4.17, >=28.0 <28.5.0.6, and >=29.0 <29.0.6, and eldap versions >=1.0.3 <1.2.14.2, >=1.2.15 <1.2.16.1, and >=1.3 <1.3.1. Exploitation requires the application to explicitly pass LDAP referral URLs to eldap:parse_ldap_url/1, which is not done internally by eldap. The vulnerability is tracked as CWE-1284 (Improper Validation of Specified Quantity in Input).

An attacker controlling or compromising an LDAP server can supply a referral URL with an extremely long numeric port component. When the vulnerable eldap:parse_port/2 function processes this input, it performs expensive arbitrary-precision integer conversion, causing significant CPU usage and degrading the availability of the affected application. There is no direct code execution or data breach impact described. The impact is limited to denial-of-service via resource exhaustion.

A fix is available in Erlang/OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6 and corresponding eldap versions 1.2.14.2, 1.2.16.1, and 1.3.1. Users should upgrade to these fixed versions to remediate the vulnerability. Until patched, applications should avoid passing untrusted LDAP referral URLs to eldap:parse_ldap_url/1, as eldap does not call this function internally. Patch status is confirmed by the vendor advisory.