CVE-2026-70405 - Vulnerability Details

- snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

Description

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.

snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.

Published: 2026-09-01

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The SNMP BER INTEGER decoder in Erlang/OTP does not enforce a size limit on the length field of integer values, which is a CWE-1284: Improper Validation of Specified Quantity in Input weakness. An attacker can send an SNMP packet with an integer field whose length field is arbitrarily large, causing the decoder to allocate and manipulate an ever‑growing big integer. This results in excessive CPU and memory consumption, eventually exhausting system resources and forcing the SNMP service to restart or crash, thereby denying availability to legitimate users.

Affected Systems

The issue exists in Erlang/OTP releases prior to OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, which correspond to SNMP 4.25.1–5.18.2.1, 5.19–5.20.2.2, and 5.20.3–5.20.5, respectively. OTP releases before 17.0 (SNMP before 4.25.1) may also be affected, but this is not confirmed.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. The exploitability is remote; any host that exposes an SNMP service over the network can be targeted without authentication. Since the vulnerability is triggered before request validation, a malicious SNMP client can send a single large integer field to trigger resource exhaustion. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, but the impact on availability could be significant in high‑traffic or mission‑critical environments.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 17.0
`17.0`	affected	< 27.3.4.17
`28.0`	affected	< 28.5.0.6
`29.0`	affected	< 29.0.6

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 4.25.1
`4.25.1`	affected	< 5.18.2.1
`5.19`	affected	< 5.20.2.2
`5.20.3`	affected	< 5.20.5

Erlang

OTP

unaffected

Version	Status	Constraints
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[0,17.0)`	unknown	generic	—
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—
`[0,4.25.1)`	unknown	generic	—
`[4.25.1,5.18.2.1)`	affected	generic	—
`[5.19,5.20.2.2)`	affected	generic	—
`[5.20.3,5.20.5)`	affected	generic	—
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[0,17.0)`	unknown	generic	—
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[0,4.25.1)`	unknown	generic	—
`[4.25.1,5.18.2.1)`	affected	generic	—
`[5.19,5.20.2.2)`	affected	generic	—
`[5.20.3,5.20.5)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Erlang/OTP to the patched release (OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 or newer).
Restrict SNMP exposure to trusted hosts using firewall rules or SNMP configuration, limiting connections to internal networks only.
Implement network monitoring to detect unusually large SNMP integer fields and block or quarantine suspicious traffic, or apply custom packet filtering to reject packets exceeding realistic size limits.

Generated by OpenCVE AI on September 1, 2026 at 17:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00421.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-70405.html
https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d
https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa
https://github.com/erlang/otp/security/advisories/GHSA-q7cq-pfgf-5hr7
https://osv.dev/vulnerability/EEF-CVE-2026-70405
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Wed, 02 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp

Tue, 01 Sep 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.
Title		snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-1284
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-70405.html https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa https://github.com/erlang/otp/security/advisories/GHSA-q7cq-pfgf-5hr7 https://osv.dev/vulnerability/EEF-CVE-2026-70405 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:50:34.263Z

Updated: 2026-09-08T01:08:55.059Z

Reserved: 2026-08-06T11:45:02.140Z

Link: CVE-2026-70405

Vulnrichment

Updated: 2026-09-01T18:10:04.295Z

NVD

Status : Deferred

Published: 2026-09-01T15:17:24.193

Modified: 2026-09-08T01:17:52.940

Link: CVE-2026-70405

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-01T17:15:05Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object