UpHeron
All vulnerabilities

Servers and applications

CVE-2026-28810

Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an…

Severity
Medium 6.3
Published
7 Apr 2026
Last changed
24 Jul 2026
Added to UpHeron
16 Oct 2026
Fixed in
26.2.5.19, 27.3.4.10, 28.4.2
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 17.0 before 26.2.5.19
  • From 27.0 before 27.3.4.10
  • From 28.0 before 28.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-28810
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28810