Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host. autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects. An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header. This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3749073b-c8f9-11f1-9ceb-4c526214c986 advisory.

    The Erlang/OTP project reports:
    OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following               issues, three of which complete earlier incomplete               fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8901-1 advisory.

    Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An     attacker could possibly use this issue to write arbitrary files outside of the intended directory. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

    It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote     attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2025-26618)

    It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key     exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive     resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,     and Ubuntu 18.04 LTS. (CVE-2025-30211)

    It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker     could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

    It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root     directory. An authenticated user could possibly use this issue to access files outside of the root     directory. (CVE-2026-23942)

    It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the     size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use     excessive resources, leading to a denial of service. (CVE-2026-23943)

    It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts     served via script aliases. A remote attacker could possibly use this issue to bypass authentication and     access protected CGI scripts. (CVE-2026-28808)

    It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize     source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This     issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

    It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A     remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation     checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

    It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file     handles. An authenticated user could possibly use this issue to modify the attributes of files outside of     the root directory. (CVE-2026-32147)

    It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate     issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

    It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A     remote attacker could possibly use this issue to bypass certificate validation. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-42790)

    It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote     attacker could possibly use this issue to forge OCSP responses using an expired responder certificate.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

    It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker     could possibly use this issue to write arbitrary files outside of the intended directory. This issue only     affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-47078)

    It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An     authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-48855)

    It was discovered that the Erlang HTTP client forwarded authorization headers on cross-origin redirects. A     malicious HTTP server could possibly use this issue to obtain sensitive information. (CVE-2026-48856)

    It was discovered that the Erlang FTP client did not validate the IP address in passive mode responses. A     malicious FTP server could possibly use this issue to perform server-side request forgery attacks.
    (CVE-2026-48858)

    It was discovered that Erlang checked the local address instead of the peer address when enforcing the     allowlist for distribution over TLS. A remote attacker could possibly use this issue to bypass access     restrictions. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-48860)

    It was discovered that Erlang incorrectly handled certain SCTP ERROR chunks, leading to a buffer overflow.
    A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of     service. (CVE-2026-49759)

    It was discovered that the Erlang erl_interface library incorrectly handled printing very large integers,     leading to a buffer overflow. An attacker could possibly use this issue to cause Erlang to crash or     execute arbitrary code. (CVE-2026-49760)

    It was discovered that the Erlang SFTP server incorrectly handled certain path resolution requests. An     authenticated user could possibly use this issue to determine the existence of files outside of the root     directory. (CVE-2026-53422)

    It was discovered that the Erlang SFTP server incorrectly handled extended channel data, leading to an     infinite loop. An authenticated user could possibly use this issue to cause a denial of service.
    (CVE-2026-54886)

    It was discovered that the Erlang DTLS server used a predictable cookie secret on startup. A remote     attacker could possibly use this issue to bypass source address verification. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-54887)

    It was discovered that Erlang TLS clients incorrectly accepted application data before the handshake was     completed. A remote attacker could possibly use this issue to inject arbitrary data into TLS connections.
    (CVE-2026-54891)

    It was discovered that the Erlang DTLS server contained a race condition when handling rapid client     reconnections. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a     denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-55950)

    It was discovered that Erlang did not properly validate TLS 1.3 pre-shared key extensions. A remote     attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This     issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-55952)

    It was discovered that the Erlang ASN.1 decoder incorrectly handled certain object identifiers. A remote     attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of     service. (CVE-2026-65634)

    It was discovered that the Erlang SSH server did not properly limit the number of open channels. An     authenticated user could possibly use this issue to cause Erlang to use excessive resources, leading to a     denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-68956)

    It was discovered that the Erlang HTTP server incorrectly shared users and groups between directories when     using dets or mnesia authentication backends. A remote attacker could possibly use this issue to bypass     authentication and access protected directories. (CVE-2026-74994)

    It was discovered that Erlang TLS clients incorrectly accepted unsolicited TLS 1.3 pre-shared keys from     servers. A remote attacker could possibly use this issue to impersonate servers. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-89422)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6464 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6464-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : erlang     CVE ID         : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147                      CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792                      CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858                      CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422                      CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891                      CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953                      CVE-2026-58227 CVE-2026-59250 CVE-2026-59251     Debian Bug     : 1139727 1139823 1141414 1142985

    Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,     real-time, distributed functional language, which may result in denial of     service, information disclosure, authentication and certificate validation     bypass, or the execution of arbitrary code. These vulnerbilities affect a     wide range of components: TLS and certificate validation (ssl, public_key),     SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),     runtime and libraries (erts, erl_interface, stdlib, megaco).

    Several of these fixes tighten checks that were previously too permissive,     and can cause configurations that worked before to stop working. The most     likely to be noticed are:

     - TLS clients using verify_peer, which is the default, now reject        certificates that carry no subjectAltName extension; the        customize_hostname_check option does not restore the old behaviour.

     - Erlang distribution over TLS with the kernel 'check_ip' option now        enforces the check that was previously a no-op, so clusters whose nodes        are not on the same subnet lose distribution connectivity until the        option is unset.

     - TLS clients that request OCSP stapling now fail the handshake when the        server provides no stapled response.

     - Clients using TLS 1.2 or earlier now abort the handshake if the server        sends an ALPN extension that the client did not advertise.

     - DNS queries made through inet_res now use randomised source ports

    For the stable distribution (trixie), these problems have been fixed in     version 1:27.3.4.1+dfsg-1+deb13u3.

    We recommend that you upgrade your erlang packages.

    For the detailed security status of erlang please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/erlang

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3645-1 advisory.

    - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
    - CVE-2026-42789: `public_key` application accepts non-CA certificates as intermediate issuers and this     enables chain       forgery (bsc#1266449).
    - CVE-2026-42790: Name constraints and `Subject CommonName` fallback in TLS hostname verification allows     for certificate       forgery by MITM attacker (bsc#1266466).
    - CVE-2026-42792: permanent `epmd` DoS via connection slot exhaustion due to improper handling of     exceptional       conditions (bsc#1272908).
    - CVE-2026-47078: relative path traversal in `zip:unzip/zip:extract` via `check_dir_level` depth-counter     bypass       (bsc#1272909).
    - CVE-2026-48855: SFTP `READLINK` response leaks absolute backend filesystem path when root is configured     (bsc#1268139).
    - CVE-2026-48856: `httpc` leaks `Authorization` headers to cross-origin redirect targets (bsc#1268141).
    - CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated `PASV`     response IP       address (bsc#1268142).
    - CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in `inet_drv` (bsc#1268163).
    - CVE-2026-49760: stack buffer overflow in `ei_s_print_term` at very large integer (bsc#1268164).
    - CVE-2026-53422: SFTP `REALPATH` path-existence oracle allows filesystem enumeration outside configured     root       (bsc#1270245).
    - CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
    - CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the     startup window       (bsc#1270247).
    - CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
    - CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in `LARGE_TUPLE_EXTP` decoding in     `erts`       external term format decoder (bsc#1272910).
    - CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed     `ClientHello`       with mismatched PSK identity and binder list lengths (bsc#1270258).
    - CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server     authentication       bypass (bsc#1272911).
    - CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate     chain       (bsc#1272913).
    - CVE-2026-59250: `megaco` flex scanner buffer overflow via oversized property parm name (bsc#1272914).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3579-1 advisory.

    - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
    - CVE-2026-42789: `public_key` application accepts non-CA certificates as intermediate issuers and this     enables chain       forgery (bsc#1266449).
    - CVE-2026-42790: Name constraints and `Subject CommonName` fallback in TLS hostname verification allows     for certificate       forgery by MITM attacker (bsc#1266466).
    - CVE-2026-42792: permanent `epmd` DoS via connection slot exhaustion due to improper handling of     exceptional       conditions (bsc#1272908).
    - CVE-2026-47078: relative path traversal in `zip:unzip/zip:extract` via `check_dir_level` depth-counter     bypass       (bsc#1272909).
    - CVE-2026-48855: SFTP `READLINK` response leaks absolute backend filesystem path when root is configured     (bsc#1268139).
    - CVE-2026-48856: `httpc` leaks `Authorization` headers to cross-origin redirect targets (bsc#1268141).
    - CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated `PASV`     response IP       address (bsc#1268142).
    - CVE-2026-48860: `ssl` (`inet_tls_dist` module) allows unauthenticated bypass of the distribution-over-     TLS LAN       allowlist (bsc#1268146).
    - CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in `inet_drv` (bsc#1268163).
    - CVE-2026-49760: stack buffer overflow in `ei_s_print_term` at very large integer (bsc#1268164).
    - CVE-2026-53422: SFTP `REALPATH` path-existence oracle allows filesystem enumeration outside configured     root       (bsc#1270245).
    - CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
    - CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the     startup window       (bsc#1270247).
    - CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
    - CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in `LARGE_TUPLE_EXTP` decoding in     `erts`       external term format decoder (bsc#1272910).
    - CVE-2026-55950: time-of-check time-of-use race condition allows an unauthenticated remote attacker to     crash all active       DTLS sessions on a listener (bsc#1270253).
    - CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed     `ClientHello`       with mismatched PSK identity and binder list lengths (bsc#1270258).
    - CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server     authentication       bypass (bsc#1272911).
    - CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate     chain       (bsc#1272913).
    - CVE-2026-59250: `megaco` flex scanner buffer overflow via oversized property parm name (bsc#1272914).
    - CVE-2026-59251: denial of service via exponential certificate policy tree growth in path validation     (bsc#1272915).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the erlang package has been released.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d87e2466-64d4-11f1-ab11-4c526214c986 advisory.

    https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh reports:
    The HTTP client (httpc) in inets now removes Authorization,               Proxy-Authorization, Cookie, Referer, and Origin headers when               following a redirect to a different host or port, following the               requirements of RFC 9110 section 15.4. Previously these headers               were forwarded verbatim, potentially leaking credentials to               unintended targets.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded     Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to     redirect targets without checking whether the redirect crosses an origin boundary.
    httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header     record; all other fields (including authorization and proxy_authorization) are copied verbatim. The     redirect target host is never compared against the original host. autoredirect defaults to true, so this     affects all httpc callers that do not explicitly disable automatic redirects. An attacker who controls a     server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also     control. The Authorization header (including Basic credentials derived from URL userinfo via     httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same     applies to the Proxy-Authorization header. This vulnerability is associated with program files     lib/inets/src/http_client/httpc_response.erl. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19,     OTP 28.5.0.8, and OTP 29.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether     OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown. (CVE-2026-48856)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367320	FreeBSD : Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp (3749073b-c8f9-11f1-9ceb-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high
365371	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8901-1)	Nessus	Ubuntu Local Security Checks	Local	critical
339216	Debian dsa-6464 : erlang - security update	Nessus	Debian Local Security Checks	Local	critical
338632	SUSE SLES15 Security Update : erlang (SUSE-SU-2026:3645-1)	Nessus	SuSE Local Security Checks	Local	critical
335097	SUSE SLES15 Security Update : erlang26 (SUSE-SU-2026:3579-1)	Nessus	SuSE Local Security Checks	Local	critical
333871	Photon OS 5.0: Erlang PHSA-2026-5.0-91-0883	Nessus	PhotonOS Local Security Checks	Local	high
323235	Photon OS 4.0: Erlang PHSA-2026-4.0-1038	Nessus	PhotonOS Local Security Checks	Local	high
321790	Photon OS 5.0: Erlang PHSA-2026-5.0-0883	Nessus	PhotonOS Local Security Checks	Local	high
320576	FreeBSD : Erlang/OTP -- httpc leaks authentication headers on cross-host redirect (d87e2466-64d4-11f1-ab11-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high
320495	Linux Distros Unpatched Vulnerability : CVE-2026-48856	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48856

high

Tenable Plugins

high

critical

critical

critical

critical

high

high

high

high

high