CVE-2026-28810

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28810", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-03T14:40:00.590Z", "datePublished": "2026-04-07T07:50:11.072Z", "dateUpdated": "2026-11-11T19:28:21.075Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "kernel", "packageURL": "pkg:otp/kernel?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/inet_db.erl", "src/inet_res.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.2.4.11", "status": "unaffected"}, {"at": "10.2.7.4", "status": "unaffected"}, {"at": "10.6.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "b057a9d995017b1be50d6dc02edd52382f3231b8", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application must use <code>inet_res</code> for DNS resolution, either by configuring the lookup method to include <code>dns</code> in the kernel inet configuration, or by calling <code>inet_res</code> functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "The application must use `inet_res` for DNS resolution, either by configuring the lookup method to include `dns` in the kernel inet configuration, or by calling `inet_res` functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected."}], "value": "The application must use inet_res for DNS resolution, either by configuring the lookup method to include dns in the kernel inet configuration, or by calling inet_res functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2.5.19", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Raimo Niskanen"}], "datePublic": "2026-04-07T07:50:11.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.</p>\n<p>The built-in DNS resolver (<code>inet_res</code>) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.</p>\n<p><code>inet_res</code> is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.</p>\n<p>This vulnerability is associated with program files <code>lib/kernel/src/inet_db.erl</code> and <code>lib/kernel/src/inet_res.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.19, OTP&nbsp;27.3.4.10, and OTP&nbsp;28.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (`inet_res`) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\n`inet_res` is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files `lib/kernel/src/inet_db.erl` and `lib/kernel/src/inet_res.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2."}], "value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2."}], "impacts": [{"capecId": "CAPEC-142", "descriptions": [{"lang": "en", "value": "CAPEC-142 DNS Cache Poisoning"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:28:21.075Z"}, "references": [{"name": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver", "tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8"}, {"name": "EEF CNA record for CVE-2026-28810", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-28810.html"}, {"name": "OSV record EEF-CVE-2026-28810", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-28810"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Introducing commit 07b8f44 in erlang/otp", "tags": ["related"], "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"}, {"name": "Fix commit b057a9d in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8"}, {"name": "Fix commit dd15e8e in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd"}, {"name": "Fix commit 36f23c9 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5"}], "source": {"discovery": "EXTERNAL"}, "title": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the <code>inet_res</code> resolver to only talk to trusted recursive name servers within that network.</p>"}, {"base64": false, "type": "text/markdown", "value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the `inet_res` resolver to only talk to trusted recursive name servers within that network."}], "value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the inet_res resolver to only talk to trusted recursive name servers within that network."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T16:27:52.481723Z", "id": "CVE-2026-28810", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T16:28:02.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28810", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T16:27:52.481723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T16:27:57.226Z"}}], "cna": {"title": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Raimo Niskanen"}], "impacts": [{"capecId": "CAPEC-142", "descriptions": [{"lang": "en", "value": "CAPEC-142 DNS Cache Poisoning"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["inet_db", "inet_res"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["inet_db", "inet_res"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "9.2.4.11", "status": "unaffected"}, {"at": "10.2.7.4", "status": "unaffected"}, {"at": "10.6.2", "status": "unaffected"}], "version": "3.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/kernel?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "kernel", "programFiles": ["src/inet_db.erl", "src/inet_res.erl"], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["inet_db", "inet_res"], "product": "OTP", "versions": [{"status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "lessThan": "b057a9d995017b1be50d6dc02edd52382f3231b8", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected"}], "datePublic": "2026-04-07T07:50:11.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8", "name": "Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-28810.html", "name": "EEF CNA record for CVE-2026-28810", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-28810", "name": "OSV record EEF-CVE-2026-28810", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79", "name": "Introducing commit 07b8f44 in erlang/otp", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8", "name": "Fix commit b057a9d in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd", "name": "Fix commit dd15e8e in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5", "name": "Fix commit 36f23c9 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the inet_res resolver to only talk to trusted recursive name servers within that network.", "supportingMedia": [{"type": "text/html", "value": "<p>Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the <code>inet_res</code> resolver to only talk to trusted recursive name servers within that network.</p>", "base64": false}, {"type": "text/markdown", "value": "Install the Erlang nodes in a trusted network shielded from DNS reply spoofing by firewalls, and configure the `inet_res` resolver to only talk to trusted recursive name servers within that network.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.</p>\n<p>The built-in DNS resolver (<code>inet_res</code>) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.</p>\n<p><code>inet_res</code> is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.</p>\n<p>This vulnerability is associated with program files <code>lib/kernel/src/inet_db.erl</code> and <code>lib/kernel/src/inet_res.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.19, OTP&nbsp;27.3.4.10, and OTP&nbsp;28.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2.</p>", "base64": false}, {"type": "text/markdown", "value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (`inet_res`) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\n`inet_res` is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files `lib/kernel/src/inet_db.erl` and `lib/kernel/src/inet_res.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}], "configurations": [{"lang": "en", "value": "The application must use inet_res for DNS resolution, either by configuring the lookup method to include dns in the kernel inet configuration, or by calling inet_res functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>The application must use <code>inet_res</code> for DNS resolution, either by configuring the lookup method to include <code>dns</code> in the kernel inet configuration, or by calling <code>inet_res</code> functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected.</p>", "base64": false}, {"type": "text/markdown", "value": "The application must use `inet_res` for DNS resolution, either by configuring the lookup method to include `dns` in the kernel inet configuration, or by calling `inet_res` functions directly. The default Erlang/OTP configuration uses native OS resolution and is not affected.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.2.5.19", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:28:21.075Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28810", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:28:21.075Z", "dateReserved": "2026-03-03T14:40:00.590Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-07T07:50:11.072Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.19", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "kernel", "packageURL": "pkg:otp/kernel?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/inet_db.erl", "src/inet_res.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.2.4.11", "status": "unaffected"}, {"at": "10.2.7.4", "status": "unaffected"}, {"at": "10.6.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_db", "inet_res"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/kernel/src/inet_db.erl", "lib/kernel/src/inet_res.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "b057a9d995017b1be50d6dc02edd52382f3231b8", "status": "affected", "version": "07b8f441ca711f9812fad9e9115bab3c3aa92f79", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E9FD459-CC4D-4592-ADB7-95ADFD4EE25B", "versionEndExcluding": "26.2.5.19", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.\n\nThe built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.\n\ninet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.\n\nThis vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.19, OTP\u00a027.3.4.10, and OTP\u00a028.4.2, corresponding to kernel from 3.0 before 9.2.4.11, 10.2.7.4, and 10.6.2."}, {"lang": "es", "value": "Vulnerabilidad de generaci\u00f3n de n\u00fameros o identificadores predecibles en el kernel de Erlang/OTP (m\u00f3dulos inet_res, inet_db) permite el envenenamiento de cach\u00e9 DNS.\n\nEl resolvedor DNS incorporado (inet_res) utiliza un ID de transacci\u00f3n secuencial, global para el proceso, de 16 bits para consultas UDP y no implementa la aleatorizaci\u00f3n del puerto de origen. La validaci\u00f3n de la respuesta se basa casi por completo en este ID, haciendo que el envenenamiento de cach\u00e9 DNS sea pr\u00e1ctico para un atacante que puede observar una consulta o predecir el siguiente ID. Esto entra en conflicto con las recomendaciones de la RFC 5452 para mitigar respuestas DNS falsificadas.\n\ninet_res est\u00e1 dise\u00f1ado para su uso en entornos de red confiables y con resolvedores recursivos confiables. La documentaci\u00f3n anterior no indicaba claramente esta suposici\u00f3n de despliegue, lo que podr\u00eda llevar a los usuarios a desplegar el resolvedor en entornos donde las respuestas DNS falsificadas son posibles.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/kernel/src/inet_db.erl y lib/kernel/src/inet_res.erl.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.2, 27.3.4.10 y 26.2.5.19 correspondiente al kernel desde 3.0 hasta 10.6.2, 10.2.7.4 y 9.2.4.11."}], "id": "CVE-2026-28810", "lastModified": "2026-11-11T20:17:08.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28810", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T16:27:52.481723Z", "version": "2.0.3"}}]}, "published": "2026-04-07T09:16:20.473", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-28810.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/07b8f441ca711f9812fad9e9115bab3c3aa92f79"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-28810"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Release Notes"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-340"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "erlang/otp: Erlang/OTP kernel: DNS cache poisoning via predictable DNS transaction IDs", "id": "2455868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455868"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-331", "details": ["A flaw was found in Erlang/OTP kernel. The built-in DNS resolver (inet_res) uses predictable 16-bit transaction IDs and lacks source port randomization. A remote attacker can exploit this by observing or predicting DNS query IDs, leading to DNS cache poisoning. This allows the attacker to redirect network traffic to malicious destinations."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28810", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-04-07T07:50:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28810\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28810\nhttps://cna.erlef.org/cves/CVE-2026-28810.html\nhttps://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5\nhttps://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8\nhttps://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd\nhttps://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8\nhttps://osv.dev/vulnerability/EEF-CVE-2026-28810\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "07b8f441ca711f9812fad9e9115bab3c3aa92f79"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "07b8f441ca711f9812fad9e9115bab3c3aa92f79"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-04-08T19:38:31.305248+00:00", "updated": "2026-08-04T19:15:03.928891+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}