Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6580 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6580-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     October 23, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : erlang     CVE ID         : CVE-2026-55951 CVE-2026-59696 CVE-2026-65634 CVE-2026-66357                      CVE-2026-66835 CVE-2026-68956 CVE-2026-69664 CVE-2026-70399                      CVE-2026-70405 CVE-2026-70409 CVE-2026-71380 CVE-2026-73270                      CVE-2026-73276 CVE-2026-73812 CVE-2026-74835 CVE-2026-74994                      CVE-2026-75538 CVE-2026-89422

    Several vulnerabilities were discovered in Erlang/OTP, a programming     language and runtime environment. These issues could result in denial of     service, HTTP request smuggling, or bypass of authentication and access     restrictions, including TLS server impersonation.

    The affected components include the HTTP client and server, SSH, TLS,     ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing. The     update tightens protocol validation and HTTP/SSH resource limits.
    Applications relying on previously permissive behavior may need     adjustment.

    For the stable distribution (trixie), these problems have been fixed in     version 1:27.3.4.1+dfsg-1+deb13u4.

    We recommend that you upgrade your erlang packages.

    For the detailed security status of erlang please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/erlang

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3749073b-c8f9-11f1-9ceb-4c526214c986 advisory.

    The Erlang/OTP project reports:
    OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following               issues, three of which complete earlier incomplete               fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote     attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is     arbitrarily large. snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and     do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and     bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively     larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site,     dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and     index, generic and specific trap fields, engine boots and time, and every varbind value decoded by     dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request     is required beyond what the deployment demands to accept the message at all. This issue affects OTP from     OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6,     corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before     5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.
    (CVE-2026-70405)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e9dfc357-a63f-11f1-9195-4c526214c986 advisory.

    The Erlang/OTP project reports:
    OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following               issues, most of them in the inets httpd and httpc               implementations:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
371200	Debian dsa-6580 : erlang - security update	Nessus	Debian Local Security Checks	Local	critical
367320	FreeBSD : Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp (3749073b-c8f9-11f1-9ceb-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high
342648	Linux Distros Unpatched Vulnerability : CVE-2026-70405	Nessus	Misc.	Local	medium
342490	FreeBSD : Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap (e9dfc357-a63f-11f1-9195-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-70405

medium

Tenable Plugins

critical

high

medium

high