The Erlang/OTP kernel’s built‑in DNS resolver, inet_res, uses predictable numbers or identifiers for request matching. The vulnerability in the inet_res and inet_db modules allows an attacker who can observe or guess these identifiers to send forged DNS responses, which the resolver accepts and caches. This flaw can lead to DNS cache poisoning, potentially redirecting traffic or exfiltrating data. The weakness is classified as a predictable number or identifier generation problem (CWE‑331, CWE‑340).

The vulnerability affects Erlang:OTP releases from 17.0 up to, but not including, 28.4.2, as well as the specific versions 27.3.4.10 and 26.2.5.19. These correspond to kernel releases 3.0 through 10.6.2, 10.2.7.4, and 9.2.4.11. The built‑in resolver is intended for use in trusted network environments and with trusted recursive resolvers.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog. An attacker with network access that can observe DNS queries executed by the Erlang nodes can predict or observe the required identifier and inject a forged response. The resolver is intended for trusted networks; deployment in environments where DNS replies can be spoofed increases the danger. The attack requires only observation or prediction of the identifier, no special privileges beyond network access.