CVE-2026-28808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28808", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-03T14:40:00.590Z", "datePublished": "2026-04-07T12:28:16.056Z", "dateUpdated": "2026-09-22T09:08:02.163Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/http_server/mod_alias.erl", "src/http_server/mod_auth.erl", "src/http_server/mod_cgi.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.1.0.6", "status": "unaffected"}, {"at": "9.3.2.4", "status": "unaffected"}, {"at": "9.6.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "8fc71ac6af4fbcc54103bec2983ef22e82942688", "status": "unaffected"}, {"at": "9dfa0c51eac97866078e808dec2183cb7871ff7c", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The inets httpd server must use <code>script_alias</code> to map a URL prefix to a CGI directory, combined with <code>directory</code>-based access controls (e.g., <code>mod_auth</code>) protecting the <code>script_alias</code> target path. The vulnerability applies whenever the <code>script_alias</code> target path differs from <code>DocumentRoot</code> + URL prefix.</p>"}, {"base64": false, "type": "text/markdown", "value": "The inets httpd server must use `script_alias` to map a URL prefix to a CGI directory, combined with `directory`-based access controls (e.g., `mod_auth`) protecting the `script_alias` target path. The vulnerability applies whenever the `script_alias` target path differs from `DocumentRoot` + URL prefix."}], "value": "The inets httpd server must use script_alias to map a URL prefix to a CGI directory, combined with directory-based access controls (e.g., mod_auth) protecting the script_alias target path. The vulnerability applies whenever the script_alias target path differs from DocumentRoot + URL prefix."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2.5.19", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak"}], "datePublic": "2026-09-08T13:37:22.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by <code>directory</code> rules when served via <code>script_alias</code>.</p>\n<p>When <code>script_alias</code> maps a URL prefix to a directory outside <code>DocumentRoot</code>, <code>mod_auth</code> evaluates <code>directory</code>-based access controls against the <code>DocumentRoot</code>-relative path while <code>mod_cgi</code> executes the script at the <code>ScriptAlias</code>-resolved path. This path mismatch allows unauthenticated access to CGI scripts that <code>directory</code> rules were meant to protect.</p>\n<p>This vulnerability is associated with program files <code>lib/inets/src/http_server/mod_alias.erl</code>, <code>lib/inets/src/http_server/mod_auth.erl</code>, and <code>lib/inets/src/http_server/mod_cgi.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.19, OTP&nbsp;27.3.4.10, and OTP&nbsp;28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by `directory` rules when served via `script_alias`.\n\nWhen `script_alias` maps a URL prefix to a directory outside `DocumentRoot`, `mod_auth` evaluates `directory`-based access controls against the `DocumentRoot`-relative path while `mod_cgi` executes the script at the `ScriptAlias`-resolved path. This path mismatch allows unauthenticated access to CGI scripts that `directory` rules were meant to protect.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/mod_alias.erl`, `lib/inets/src/http_server/mod_auth.erl`, and `lib/inets/src/http_server/mod_cgi.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.\n\nWhen script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-22T09:08:02.163Z"}, "references": [{"name": "GitHub Advisory", "tags": ["related", "vendor-advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f"}, {"name": "EEF CNA record for CVE-2026-28808", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-28808.html"}, {"name": "OSV record EEF-CVE-2026-28808", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-28808"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Introducing commit 07b8f44 in erlang/otp", "tags": ["related"], "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"}, {"name": "Fix commit 8fc71ac in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688"}, {"name": "Fix commit 9dfa0c5 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c"}], "source": {"discovery": "EXTERNAL"}, "title": "ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul>\n<li>Move CGI scripts inside <code>DocumentRoot</code> and use <code>alias</code> instead of <code>script_alias</code> to ensure <code>mod_auth</code> resolves the correct path.</li>\n<li>Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the <code>script_alias</code> URL prefix.</li>\n<li>Remove <code>mod_cgi</code> from the httpd modules chain if CGI functionality is not required.</li>\n</ul>"}, {"base64": false, "type": "text/markdown", "value": "* Move CGI scripts inside `DocumentRoot` and use `alias` instead of `script_alias` to ensure `mod_auth` resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the `script_alias` URL prefix.\n* Remove `mod_cgi` from the httpd modules chain if CGI functionality is not required."}], "value": "* Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix.\n* Remove mod_cgi from the httpd modules chain if CGI functionality is not required."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T13:14:10.515632Z", "id": "CVE-2026-28808", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:14:16.481Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "unaffected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "datePublic": "2026-04-07T12:28:16.056Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP (inets modules). A remote unauthenticated attacker could exploit an incorrect authorization vulnerability when CGI (Common Gateway Interface) scripts are served via script_alias. This vulnerability arises from a path mismatch where access controls are evaluated against a different path than the script's execution path. This allows unauthorized access to CGI scripts intended to be protected by directory rules, potentially leading to information disclosure or the execution of unauthorized scripts."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-551", "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-28808"}, {"name": "RHBZ#2455909", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455909"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json"}], "timeline": [{"lang": "en", "time": "2026-04-07T13:01:42.326Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-07T12:28:16.056Z", "value": "Made public."}], "title": "erlang/otp: inets: Erlang OTP inets modules: Unauthenticated access to protected CGI scripts via incorrect authorization", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:11:29.745Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "erlang/otp: inets: Erlang OTP inets modules: Unauthenticated access to protected CGI scripts via incorrect authorization", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-07T13:01:42.326Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-07T12:28:16.056Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-04-07T12:28:16.056Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-28808", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455909", "name": "RHBZ#2455909", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json", "tags": ["x_sadp-csaf-vex"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP (inets modules). A remote unauthenticated attacker could exploit an incorrect authorization vulnerability when CGI (Common Gateway Interface) scripts are served via script_alias. This vulnerability arises from a path mismatch where access controls are evaluated against a different path than the script's execution path. This allows unauthorized access to CGI scripts intended to be protected by directory rules, potentially leading to information disclosure or the execution of unauthorized scripts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-551", "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:11:29.745Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28808", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T13:14:10.515632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:14:12.725Z"}}], "cna": {"title": "ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "9.1.0.6", "status": "unaffected"}, {"at": "9.3.2.4", "status": "unaffected"}, {"at": "9.6.2", "status": "unaffected"}], "version": "5.10", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "inets", "programFiles": ["src/http_server/mod_alias.erl", "src/http_server/mod_auth.erl", "src/http_server/mod_cgi.erl"], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "8fc71ac6af4fbcc54103bec2983ef22e82942688", "status": "unaffected"}, {"at": "9dfa0c51eac97866078e808dec2183cb7871ff7c", "status": "unaffected"}], "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown"}], "datePublic": "2026-09-08T13:37:22.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f", "name": "GitHub Advisory", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-28808.html", "name": "EEF CNA record for CVE-2026-28808", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-28808", "name": "OSV record EEF-CVE-2026-28808", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79", "name": "Introducing commit 07b8f44 in erlang/otp", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688", "name": "Fix commit 8fc71ac in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c", "name": "Fix commit 9dfa0c5 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "* Move CGI scripts inside DocumentRoot and use alias instead of script_alias to ensure mod_auth resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the script_alias URL prefix.\n* Remove mod_cgi from the httpd modules chain if CGI functionality is not required.", "supportingMedia": [{"type": "text/html", "value": "<ul>\n<li>Move CGI scripts inside <code>DocumentRoot</code> and use <code>alias</code> instead of <code>script_alias</code> to ensure <code>mod_auth</code> resolves the correct path.</li>\n<li>Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the <code>script_alias</code> URL prefix.</li>\n<li>Remove <code>mod_cgi</code> from the httpd modules chain if CGI functionality is not required.</li>\n</ul>", "base64": false}, {"type": "text/markdown", "value": "* Move CGI scripts inside `DocumentRoot` and use `alias` instead of `script_alias` to ensure `mod_auth` resolves the correct path.\n* Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to the `script_alias` URL prefix.\n* Remove `mod_cgi` from the httpd modules chain if CGI functionality is not required.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.\n\nWhen script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by <code>directory</code> rules when served via <code>script_alias</code>.</p>\n<p>When <code>script_alias</code> maps a URL prefix to a directory outside <code>DocumentRoot</code>, <code>mod_auth</code> evaluates <code>directory</code>-based access controls against the <code>DocumentRoot</code>-relative path while <code>mod_cgi</code> executes the script at the <code>ScriptAlias</code>-resolved path. This path mismatch allows unauthenticated access to CGI scripts that <code>directory</code> rules were meant to protect.</p>\n<p>This vulnerability is associated with program files <code>lib/inets/src/http_server/mod_alias.erl</code>, <code>lib/inets/src/http_server/mod_auth.erl</code>, and <code>lib/inets/src/http_server/mod_cgi.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.19, OTP&nbsp;27.3.4.10, and OTP&nbsp;28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by `directory` rules when served via `script_alias`.\n\nWhen `script_alias` maps a URL prefix to a directory outside `DocumentRoot`, `mod_auth` evaluates `directory`-based access controls against the `DocumentRoot`-relative path while `mod_cgi` executes the script at the `ScriptAlias`-resolved path. This path mismatch allows unauthenticated access to CGI scripts that `directory` rules were meant to protect.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/mod_alias.erl`, `lib/inets/src/http_server/mod_auth.erl`, and `lib/inets/src/http_server/mod_cgi.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "configurations": [{"lang": "en", "value": "The inets httpd server must use script_alias to map a URL prefix to a CGI directory, combined with directory-based access controls (e.g., mod_auth) protecting the script_alias target path. The vulnerability applies whenever the script_alias target path differs from DocumentRoot + URL prefix.", "supportingMedia": [{"type": "text/html", "value": "<p>The inets httpd server must use <code>script_alias</code> to map a URL prefix to a CGI directory, combined with <code>directory</code>-based access controls (e.g., <code>mod_auth</code>) protecting the <code>script_alias</code> target path. The vulnerability applies whenever the <code>script_alias</code> target path differs from <code>DocumentRoot</code> + URL prefix.</p>", "base64": false}, {"type": "text/markdown", "value": "The inets httpd server must use `script_alias` to map a URL prefix to a CGI directory, combined with `directory`-based access controls (e.g., `mod_auth`) protecting the `script_alias` target path. The vulnerability applies whenever the `script_alias` target path differs from `DocumentRoot` + URL prefix.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.2.5.19"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-22T09:08:02.163Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28808", "state": "PUBLISHED", "dateUpdated": "2026-09-22T09:08:02.163Z", "dateReserved": "2026-03-03T14:40:00.590Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-07T12:28:16.056Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/http_server/mod_alias.erl", "src/http_server/mod_auth.erl", "src/http_server/mod_cgi.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.1.0.6", "status": "unaffected"}, {"at": "9.3.2.4", "status": "unaffected"}, {"at": "9.6.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/mod_alias.erl", "lib/inets/src/http_server/mod_auth.erl", "lib/inets/src/http_server/mod_cgi.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "8fc71ac6af4fbcc54103bec2983ef22e82942688", "status": "unaffected"}, {"at": "9dfa0c51eac97866078e808dec2183cb7871ff7c", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "unaffected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A8568B7-8E4D-46D4-BC89-E90031B0E3A5", "versionEndExcluding": "9.1.0.6", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACE12B86-B0FA-4238-850C-60FD497A5DEE", "versionEndExcluding": "9.3.2.4", "versionStartExcluding": "9.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "6826C53A-1EB6-4465-93EA-AC464AB322EE", "versionEndExcluding": "9.6.2", "versionStartExcluding": "9.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E9FD459-CC4D-4592-ADB7-95ADFD4EE25B", "versionEndExcluding": "26.2.5.19", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.\n\nWhen script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n incorrecta en Erlang OTP (m\u00f3dulos inets) permite acceso no autenticado a scripts CGI protegidos por reglas de directorio cuando se sirven a trav\u00e9s de script_alias.\n\nCuando script_alias mapea un prefijo de URL a un directorio fuera de DocumentRoot, mod_auth eval\u00faa los controles de acceso basados en directorio contra la ruta relativa a DocumentRoot mientras mod_cgi ejecuta el script en la ruta resuelta por ScriptAlias. Esta falta de coincidencia de rutas permite acceso no autenticado a scripts CGI que las reglas de directorio estaban destinadas a proteger.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, y lib/inets/src/http_server/mod_cgi.erl.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.2, 27.3.4.10 y 26.2.5.19 correspondiente a inets desde 5.10 hasta 9.6.2, 9.3.2.4 y 9.1.0.6."}], "id": "CVE-2026-28808", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28808", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T13:14:10.515632Z", "version": "2.0.3"}}]}, "published": "2026-04-07T13:16:46.320", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-28808.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-28808"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-28808"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455909"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28808.json"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-551"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "erlang/otp: inets: Erlang OTP inets modules: Unauthenticated access to protected CGI scripts via incorrect authorization", "id": "2455909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455909"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-551", "details": ["A flaw was found in Erlang OTP (inets modules). A remote unauthenticated attacker could exploit an incorrect authorization vulnerability when CGI (Common Gateway Interface) scripts are served via script_alias. This vulnerability arises from a path mismatch where access controls are evaluated against a different path than the script's execution path. This allows unauthorized access to CGI scripts intended to be protected by directory rules, potentially leading to information disclosure or the execution of unauthorized scripts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28808", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-04-07T12:28:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28808\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28808\nhttps://cna.erlef.org/cves/CVE-2026-28808.html\nhttps://github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688\nhttps://github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c\nhttps://github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f\nhttps://osv.dev/vulnerability/EEF-CVE-2026-28808\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "9.3.2.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "9.1.0.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "26.2.5.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "8fc71ac6af4fbcc54103bec2983ef22e82942688"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "9dfa0c51eac97866078e808dec2183cb7871ff7c"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "9.3.2.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "9.1.0.6"}}], "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "26.2.5.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[07b8f441ca711f9812fad9e9115bab3c3aa92f79,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "8fc71ac6af4fbcc54103bec2983ef22e82942688"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "9dfa0c51eac97866078e808dec2183cb7871ff7c"}}], "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-04-08T19:38:09.634797+00:00", "updated": "2026-09-08T15:30:18.247595+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}