UpHeron
All vulnerabilities

Servers and applications

CVE-2026-48860

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local…

Severity
High 7.5
Published
10 Jun 2026
Last changed
24 Sept 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.13, 28.5.0.2, 29.0.2
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 26.0 before 27.3.4.13
  • From 28.0 before 28.5.0.2
  • From 29.0 before 29.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-48860
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-48860