Threats Tagged 'cve-2026-70409'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple erlang27 packages, addressing several vulnerabilities. The update provides bug fixes and enhancements for these packages across aarch64 and x86_64 architectures. The advisory references multiple CVEs related to these packages and indicates a high severity level. A patch is available to address these issues.

CVE-2026-70409 is a medium-severity vulnerability in Erlang/OTP's eldap module involving improper validation of the port component in LDAP referral URLs. A malicious or compromised LDAP server can supply a referral URL with an excessively long numeric port, causing the eldap:parse_port/2 function to perform costly arbitrary-precision integer conversions. This can degrade application availability by consuming significant processing time. The flaw affects multiple OTP versions from 17.0 up to but excluding patched versions 27.3.4.17, 28.5.0.6, and 29.0.6, as well as corresponding eldap library versions. Exploitation requires the application to pass server-supplied referrals to eldap:parse_ldap_url/1, which eldap itself does not call internally. No known exploits are reported in the wild.